PT-2007-1908 · Intersystems · Intersystems Cache

Published 2007-08-20 · Updated 2008-09-05 · CVE-2007-0437

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions InterSystems Cache (affected versions not specified)

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the sample Cache Server Page (CSP) scripts. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific parameters in various scripts, including the TO parameter to "loop.csp", the VALUE parameter to "cookie.csp", and the PAGE parameter to "showsource.csp". Additionally, remote authenticated users can inject arbitrary web script or HTML via the ERROR parameter to "csp/samples/xmlclasseserror.csp" and unspecified vectors in "object.csp" and "lotteryhistory.csp".

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2007-0437

Affected Products

Intersystems Cache

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2007-0437 · Security Note
• http://mwrinfosecurity.com/news/1658.html · Note
• http://mwrinfosecurity.com/advisories/mwri_cache-sample-files-xss-advisory_2007-04-04.pdf · Note
• http://cpni.gov.uk/Products/alerts/2928.aspx · Note