PT-2008-3554 · Xoops+3 · Xoops+7

Published 2008-04-30 · Updated 2017-08-08 · CVE-2008-2035

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Bluemoon, Inc. BackPack versions 0.91 and earlier Bluemoon, Inc. BmSurvey versions 0.84 and earlier Bluemoon, Inc. newbb fileup versions 1.83 and earlier Bluemoon, Inc. News embed (news fileup) versions 1.44 and earlier Bluemoon, Inc. PopnupBlog versions 3.19 and earlier

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. This affects modules for XOOPS 2.0.x, XOOPS Cube 2.1, and ImpressCMS.

Recommendations For BackPack versions 0.91 and earlier, update to a version later than 0.91. For BmSurvey versions 0.84 and earlier, update to a version later than 0.84. For newbb fileup versions 1.83 and earlier, update to a version later than 1.83. For News embed (news fileup) versions 1.44 and earlier, update to a version later than 1.44. For PopnupBlog versions 3.19 and earlier, update to a version later than 3.19.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-2035

Affected Products

Backpack

Bmsurvey

Impresscms

News Embed

Popnupblog

Xoops

Xoops Cube

Newbb Fileup

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2008-2035 · Security Note
• http://secunia.com/advisories/29993 · Vendor Advisory
• http://jvn.jp/jp/JVN%2331351020/index.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42072 · Note
• http://securityfocus.com/bid/28966 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2035 · Note
• http://bluemooninc.biz/~xoops/modules/news/article.php?storyid=69 · Note