PT-2007-3413 · Unknown · Open-Gorotto

Published 2007-04-18 · Updated 2011-03-08 · CVE-2007-2071

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Open-gorotto versions 2.0a 2006/02/08 edition through 2006/04/07 edition

Description The issue allows remote attackers to inject arbitrary web script or HTML via unspecified parameters to various API endpoints, including (1) "pub/modules/d/ top.html", (2) "/pub/modules/a/ access.html", (3) " circletop.html" or (4) " cir66.html" in "pub/modules/ci/", or (5) " fri66.html", (6) " inv66.html", (7) " top.html", (8) " friends.html", or (9) " fri33.html" in "pub/modules/f/".

Recommendations For Open-gorotto versions 2.0a 2006/02/08 edition through 2006/04/07 edition, consider updating to a version released after 20070416 to resolve the issue. As a temporary workaround, consider restricting access to the affected API endpoints until a patch is available. Avoid using unspecified parameters in the affected API endpoints until the issue is resolved.

Fix

Related Identifiers

CVE-2007-2071

Affected Products

Open-Gorotto

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2007-2071 · Security Note
• http://securityfocus.com/bid/23507 · Note
• http://osvdb.org/37594 · Note
• http://vupen.com/english/advisories/2007/1398 · Note
• http://osvdb.org/37597 · Note
• http://jvn.jp/jp/JVN%2384646028/index.html · Note
• http://osvdb.org/37595 · Note
• http://osvdb.org/37596 · Note
• http://osvdb.org/37601 · Note
• http://osvdb.org/37598 · Note
• http://release.open-gorotto.jp/openg_patch_20070416.tar.gz · Note
• http://osvdb.org/37593 · Note
• http://release.open-gorotto.jp · Note
• http://osvdb.org/37599 · Note
• http://osvdb.org/37600 · Note