PT-2006-6793 · Deskpro · Deskpro

Published 2006-11-28 · Updated 2017-07-29 · CVE-2006-6159

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions DeskPRO versions 2.0.0 through 2.0.1

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the message or subject parameter in the "newticket.php" file.

Recommendations For DeskPRO versions 2.0.0 through 2.0.1, consider restricting access to the newticket.php file until a patch is available. As a temporary workaround, avoid using the message and subject parameters in the affected file to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2006-6159

Affected Products

Deskpro

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2006-6159 · Security Note
• http://secunia.com/advisories/22991 · Vendor Advisory
• http://vupen.com/english/advisories/2006/4676 · Vendor Advisory
• http://zion-security.com/text/Mul_Vulnerability_DeskPro.txt · Note
• http://securityfocus.com/bid/21248 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/30520 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6159 · Note
• http://osvdb.org/30671 · Note