PT-2007-2837 · Woltlab · Woltlab Burning Board+1

Published 2007-03-14 · Updated 2018-10-16 · CVE-2007-1443

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Woltlab Burning Board versions 2.3.6 Burning Board Lite version 1.0.2pl3e

Description The issue allows remote attackers to inject arbitrary web script or HTML via multiple parameters in the register.php file. A third-party researcher has disputed some of the vectors, stating that only the r dateformat and r timeformat parameters in Burning Board 2.3.6 are affected.

Recommendations For Woltlab Burning Board version 2.3.6, consider disabling the register.php file or restricting access to it until a patch is available. For Burning Board Lite version 1.0.2pl3e, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2007-1443

Affected Products

Burning Board Lite

Woltlab Burning Board

References · 8

• http://secunia.com/advisories/24386 · Vendor Advisory
• http://secunia.com/advisories/24404 · Vendor Advisory
• http://vupen.com/english/advisories/2007/0856 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-1443 · Security Note
• http://securityreason.com/securityalert/2424 · Note
• http://securityfocus.com/archive/1/461737/100/100/threaded · Note
• http://securityfocus.com/archive/1/461744/100/100/threaded · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1443 · Note