PT-2006-6405 · Zend · Zendgdata

Published 2006-11-04 · Updated 2018-10-17 · CVE-2006-5717

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Zend Google Data Client Library (ZendGData) Preview version 0.2.0

Description: The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in files such as basedemo.php and calenderdemo.php in the samples/ directory, and other unspecified files.

Recommendations: For Zend Google Data Client Library (ZendGData) Preview version 0.2.0, consider restricting access to the affected demo files, such as basedemo.php and calenderdemo.php, until a fix is available. Avoid using unspecified parameters in these files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2006-5717

Affected Products

Zendgdata

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2006-5717 · Security Note
• http://securityreason.com/securityalert/1815 · Note
• http://armorize.com/resources/vulnerability.php?Keyword=Armorize-ADV-2006-0008 · Note
• http://securityfocus.com/archive/1/450245/100/0/threaded · Note
• http://securityfocus.com/bid/20851 · Note