PT-2007-1403 · Joomla · Joomla Bsq Sitestats

Published 2007-03-06 · Updated 2018-10-16 · CVE-2006-7125

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Joomla BSQ Sitestats versions 1.8.0 through 2.2.1

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header. This occurs because the HTTP Referer header is not properly handled when the administrator views site statistics.

Recommendations For Joomla BSQ Sitestats version 1.8.0, update to a version that properly handles the HTTP Referer header. For Joomla BSQ Sitestats version 2.2.1, update to a version that properly handles the HTTP Referer header. As a temporary workaround, consider restricting access to the site statistics view for administrators until a patch is available.

Fix

Related Identifiers

CVE-2006-7125

Affected Products

Joomla Bsq Sitestats

References · 6

• http://securityfocus.com/bid/20614 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2006-7125 · Security Note
• http://secunia.com/secunia_research/2006-65/advisory · Vendor Advisory
• http://vupen.com/english/advisories/2006/4090 · Note
• http://securityfocus.com/archive/1/449125/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/29661 · Note