PT-2007-5042 · Sitescape · Sitescape Forum

Published 2007-07-17 · Updated 2018-10-15 · CVE-2007-3807

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: SiteScape Forum versions prior to 7.3

Description: The issue allows remote attackers to inject arbitrary web script or HTML via the user name field in the login procedure. This is a result of multiple cross-site scripting (XSS) vulnerabilities. XSS is a type of attack where an attacker injects malicious scripts into a website, which are then executed by the user's browser. This can lead to unauthorized access to sensitive data or taking control of the user's session.

Recommendations: For versions prior to 7.3, update to version 7.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the login procedure to minimize the risk of exploitation. Avoid using the user name field in the login procedure until the issue is resolved.

Fix

Related Identifiers

CVE-2007-3807

Affected Products

Sitescape Forum

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2007-3807 · Security Note
• http://secunia.com/advisories/26065 · Patch
• http://securityfocus.com/bid/24893 · Note
• http://osvdb.org/36844 · Note
• http://securityfocus.com/archive/1/473624/100/0/threaded · Note
• http://scip.ch/cgi-bin/smss/showadvf.pl?id=3159 · Note
• http://securityreason.com/securityalert/2893 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35395 · Note