PT-2007-1302 · Fx-App · Fx-App

Luny · Published 2007-02-15 · Updated 2018-10-16 · CVE-2006-7023

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions fx-APP version 0.0.8.1

Description The issue allows remote attackers to inject arbitrary HTML or web script via several fields, including the search box, url, website, comment, and signature fields in the profile, and possibly a menu item. This can lead to cross-site scripting (XSS) attacks.

Recommendations For fx-APP version 0.0.8.1, consider disabling the search box and restricting input in the url, website, comment, and signature fields in the profile until a patch is available. Avoid using potentially vulnerable menu items until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2006-7023

Affected Products

Fx-App

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2006-7023 · Security Note
• http://securityreason.com/securityalert/2251 · Note
• http://securityfocus.com/bid/18361 · Note
• http://securityfocus.com/archive/1/436691/30/4500/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27167 · Note
• http://securityfocus.com/archive/1/469825/100/100/threaded · Note