PT-2007-1047 · Just For Fun · Jffnms

Published 2007-06-12 · Updated 2018-10-16 · CVE-2007-3189

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions: Just For Fun Network Management System (JFFNMS) version 0.8.3

Description: A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML. This can be achieved via the user parameter in the auth.php file. Multiple vulnerabilities in the jffnms package may lead to confidentiality and integrity breaches, and can be exploited remotely.

Recommendations: For Just For Fun Network Management System (JFFNMS) version 0.8.3, consider disabling the auth.php file or restricting access to it until a patch is available. Avoid using the user parameter in the affected auth.php file until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

BDU:2015-04130

CVE-2007-3189

DSA-1374-1

Affected Products

Jffnms

References · 13

• 🔥 https://exploit-db.com/exploits/30172 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3191 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3189 · Security Note
• http://debian.org/security/2007/dsa-1374 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04130 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2007-3189 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3190 · Security Note
• http://marc.info/?l=full-disclosure&m=118151087109711&w=2 · Note
• http://securityfocus.com/bid/24414 · Note
• http://securityfocus.com/archive/1/471039/100/0/threaded · Note
• http://debian.org/security/dsa-1374 · Note
• http://secunia.com/advisories/26769 · Note
• http://secunia.com/advisories/25587 · Note