PT-2005-5138 · Unknown · Cleanhtml.Pl

Published 2005-12-21 · Updated 2008-09-05 · CVE-2005-4455

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions cleanhtml.pl version 1.129

Description The issue allows remote attackers to inject scripting languages via the XSL namespace in XML. This can be achieved through vectors such as customview.cgi.

Recommendations For cleanhtml.pl version 1.129, consider updating to a version released after Dec 13 2005 to resolve the issue. As a temporary workaround, restrict access to customview.cgi to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2005-4455

Affected Products

Cleanhtml.Pl

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2005-4455 · Security Note
• http://secunia.com/advisories/18157 · Vendor Advisory
• http://cvs.livejournal.org/browse.cgi/livejournal/cgi-bin/cleanhtml.pl · Note