PT-2007-2650 · Nullsoft · Nullsoft Shoutcast Server

Published 2007-03-02 · Updated 2018-10-16 · CVE-2007-1229

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Nullsoft ShoutcastServer version 1.9.7

Description The issue is related to a cross-site scripting (XSS) vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the top-level URI on the Incoming interface (port 8001/tcp). The administrator interface does not properly handle this when viewing the log file.

Recommendations For Nullsoft ShoutcastServer version 1.9.7, consider restricting access to the administrator interface and the Incoming interface on port 8001/tcp to minimize the risk of exploitation. As a temporary workaround, avoid viewing the log file in the administrator interface until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2007-1229

Affected Products

Nullsoft Shoutcast Server

References · 10

• 🔥 https://exploit-db.com/exploits/29685 · Exploit
• 🔥 http://archives.neohapsis.com/archives/fulldisclosure/2007-02/0604.html · Exploit
• 🔥 http://securityfocus.com/bid/22742 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-1229 · Security Note
• http://secunia.com/advisories/24323 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32726 · Note
• http://securityfocus.com/archive/1/461474/100/0/threaded · Note
• http://vupen.com/english/advisories/2007/0775 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1229 · Note
• http://osvdb.org/33793 · Note