PT-2006-5906 · Pebble · Pebble

Paolo Perego · Published 2006-10-04 · Updated 2018-10-17 · CVE-2006-5168

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Pebble versions 2.0.0 RC1 through 2.0.0 RC2

Description A cross-site scripting (XSS) issue exists in the search functionality, allowing remote attackers to inject arbitrary web script or HTML via the query string. This could potentially lead to unauthorized actions on the affected system.

Recommendations For versions 2.0.0 RC1 and 2.0.0 RC2, consider disabling the search functionality until a patch is available to prevent exploitation of the XSS vulnerability.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2006-5168

Affected Products

Pebble

References · 6

• http://svn.sourceforge.net/viewvc/pebble/trunk/src/net/sourceforge/pebble/search/SearchResults.java?r1=136&r2=206 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2006-5168 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29312 · Note
• http://securityfocus.com/archive/1/447503/100/0/threaded · Note
• http://securityreason.com/securityalert/1689 · Note
• http://securityfocus.com/bid/20298 · Note