PT-2006-3875 · Labwiki · Labwiki

Steven M. Christey · Published 2006-06-12 · Updated 2018-10-18 · CVE-2006-2968

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions LabWiki version 1.0

Description A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the query parameter in the search input box of the search.php file.

Recommendations For LabWiki version 1.0, consider validating and sanitizing user input for the query parameter in the search.php file to prevent XSS attacks. As a temporary workaround, restrict access to the search functionality until a proper fix is applied.

Fix

Related Identifiers

CVE-2006-2968

Affected Products

Labwiki

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2006-2968 · Security Note
• http://osvdb.org/26597 · Note
• http://securityreason.com/securityalert/1092 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26988 · Note
• http://securitytracker.com/id?1016227 · Note
• http://securityfocus.com/bid/18288 · Note
• http://securityfocus.com/archive/1/435981/100/0/threaded · Note
• http://attrition.org/pipermail/vim/2006-June/000845.html · Note