PT-2006-3598 · Pre · Pre News Manager

Luny · Published 2006-05-31 · Updated 2018-10-18 · CVE-2006-2678

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Pre News Manager version 1.0

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the id parameter to "index.php" and the nid parameter to several other endpoints, including "news detail.php", "email story.php", "thankyou.php", "printable view.php", "tella friend.php", and "send comments.php".

Recommendations For Pre News Manager version 1.0, consider restricting access to the id parameter in "index.php" and the nid parameter in the affected endpoints until a patch is available. As a temporary workaround, avoid using the id and nid parameters in the respective API endpoints.

Fix

Related Identifiers

CVE-2006-2678

Affected Products

Pre News Manager

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2006-2678 · Security Note
• http://osvdb.org/26071 · Note
• http://osvdb.org/26067 · Note
• http://securityreason.com/securityalert/996 · Note
• http://secunia.com/advisories/20284 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26692 · Note
• http://securityfocus.com/archive/1/435020/100/0/threaded · Note
• http://osvdb.org/26070 · Note
• http://osvdb.org/26068 · Note
• http://securityfocus.com/bid/18333 · Note
• http://osvdb.org/26072 · Note
• http://vupen.com/english/advisories/2006/1990 · Note
• http://osvdb.org/26069 · Note
• http://osvdb.org/26066 · Note