PT-2006-2442 · Annuaire · Annuaire

Published 2006-04-03 · Updated 2017-07-20 · CVE-2006-1434

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Annuaire (Directory) version 1.0

Description A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the COMMENTAIRE parameter in the Comment Field of inscription.php.

Recommendations For Annuaire (Directory) version 1.0, consider restricting access to the inscription.php file or disabling the Comment Field until a fix is available. Avoid using the COMMENTAIRE parameter in the affected endpoint to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2006-1434

Affected Products

Annuaire

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2006-1434 · Security Note
• http://securityfocus.com/bid/17393 · Note
• http://osvdb.org/ref/24/24302-annuaire_directory.txt · Note
• http://osvdb.org/24303 · Note
• http://secunia.com/advisories/19548 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25669 · Note