PT-2005-4810 · Ideal · Ideal Bb.Net

Published 2005-12-08 · Updated 2017-07-20 · CVE-2005-4078

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Ideal BB.NET versions 1.3 and earlier

Description The issue allows remote attackers to inject arbitrary web script or HTML via several parameters in different API endpoints, including the forumID, boardID, and topicRepeater1-p parameters in "topics.aspx", the boardID parameter in "categoryindex.aspx", the postID parameter in "posts.aspx", the catID parameter in "forums.aspx", and the memberID parameter in "member.aspx".

Recommendations For Ideal BB.NET versions 1.3 and earlier, as a temporary workaround, consider restricting access to the vulnerable parameters forumID, boardID, topicRepeater1-p, postID, catID, and memberID in their respective API endpoints until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Related Identifiers

CVE-2005-4078

Affected Products

Ideal Bb.Net

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2005-4078 · Security Note
• http://secunia.com/advisories/17906 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/23471 · Note
• http://osvdb.org/21514 · Note
• http://pridels0.blogspot.com/2005/12/ideal-bbnet-13-xss-vuln.html · Note
• http://osvdb.org/21512 · Note
• http://vupen.com/english/advisories/2005/2757 · Note
• http://osvdb.org/21511 · Note
• http://osvdb.org/21515 · Note
• http://osvdb.org/21513 · Note