PT-2007-2572 · Kayako · Esupport

Doz · Published 2007-02-27 · Updated 2018-10-16 · CVE-2007-1145

NVD

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Multiple cross-site scripting (XSS) vulnerabilities in Kayako SupportSuite - ESupport 3.00.13 and 3.04.10 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to a (1) lostpassword or (2) register action in index.php, (3) unspecified vectors in the Submit form in a submit action in index.php, and (4) the user's name in index.php; and (5) allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to the Admin and Staff Control Panel. NOTE: this might issue overlap CVE-2004-1412, CVE-2005-0487, or CVE-2005-0842.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2007-1145

Affected Products

Esupport

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2007-1145 · Security Note
• http://secunia.com/advisories/24223 · Vendor Advisory
• http://osvdb.org/33536 · Note
• http://securityfocus.com/archive/1/460591/100/0/threaded · Note
• http://osvdb.org/33535 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1145 · Note
• http://vupen.com/english/advisories/2007/0717 · Note
• http://securityreason.com/securityalert/2335 · Note
• http://securityfocus.com/bid/22631 · Note