PT-2007-1568 · Nuked Klan · Nuked-Klan

Published 2007-01-05 · Updated 2018-10-16 · CVE-2007-0083

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Nuked Klan versions 1.7 and earlier

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via a javascript: URI in a getURL statement in a .swf file. This could potentially lead to remote cookie disclosure.

Recommendations For Nuked Klan versions 1.7 and earlier, consider restricting the use of getURL statements in .swf files to minimize the risk of exploitation. As a temporary workaround, avoid using javascript: URIs in getURL statements until a fix is available.

Fix

Related Identifiers

CVE-2007-0083

Affected Products

Nuked-Klan

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2007-0083 · Security Note
• http://securityfocus.com/bid/21850 · Note
• http://securityfocus.com/archive/1/455726/100/0/threaded · Note
• http://securityreason.com/securityalert/2101 · Note
• http://osvdb.org/33368 · Note