PT-2007-4548 · Papoo · Papoo Light

Published 2007-06-19 · Updated 2018-10-16 · CVE-2007-3269

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Papoo Light version 3.6 before 20070611

Description The issue allows remote attackers to inject arbitrary web script or HTML via the URI in a GET request or the Title field of a visitor comment. Additionally, remote authenticated users can inject arbitrary web script or HTML via a message to another user.

Recommendations For Papoo Light version 3.6 before 20070611, update to a version released after 20070611 to resolve the issue. As a temporary workaround, consider restricting user input in the Title field of visitor comments and limiting the ability to send messages to other users. Avoid using the URI in a GET request with untrusted input until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2007-3269

Affected Products

Papoo Light

References · 10

• 🔥 http://securityfocus.com/bid/24494 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-3269 · Security Note
• http://securityreason.com/securityalert/2825 · Note
• http://osvdb.org/37545 · Note
• http://osvdb.org/37546 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34888 · Note
• http://secunia.com/advisories/25708 · Note
• http://papoo.de/index/menuid/204/reporeid/215 · Note
• http://securityfocus.com/archive/1/471490/100/0/threaded · Note
• http://osvdb.org/37544 · Note