PT-2007-2251 · Flashchat · Flashchat

Binaryloc · Published 2007-02-07 · Updated 2018-10-16 · CVE-2007-0807

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions flashChat version 4.7.8

Description A cross-site scripting (XSS) issue exists due to improper handling of the channel title, also known as the room name, by the "who's online" feature. This allows remote attackers to inject arbitrary web script or HTML.

Recommendations For flashChat version 4.7.8, ensure that user input for channel titles is properly sanitized to prevent XSS attacks. As a temporary workaround, consider restricting the ability to create or edit channel titles until a fix is available.

Fix

Related Identifiers

CVE-2007-0807

Affected Products

Flashchat

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2007-0807 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32208 · Note
• http://securityfocus.com/bid/22411 · Note
• http://secunia.com/advisories/24071 · Note
• http://vupen.com/english/advisories/2007/0495 · Note
• http://securityreason.com/securityalert/2228 · Note
• http://securityfocus.com/archive/1/459160/100/0/threaded · Note