PT-2008-5117 · Lussumo · Lussumo Vanilla

James Bercegay · Published 2008-08-21 · Updated 2018-10-11 · CVE-2008-3758

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Lussumo Vanilla versions 1.1.4 and earlier

Description The issue allows remote attackers to inject arbitrary web script or HTML via the NewPassword parameter to "people.php". Additionally, remote authenticated users can inject arbitrary web script or HTML via the Account picture and Icon fields in "account.php".

Recommendations For versions 1.1.4 and earlier, update to a version that addresses these issues, ensuring that the NewPassword parameter in "people.php" and the Account picture and Icon fields in "account.php" are properly sanitized to prevent arbitrary web script or HTML injection. As a temporary workaround, consider restricting access to the "people.php" and "account.php" pages until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-3758

Affected Products

Lussumo Vanilla

References · 12

• 🔥 http://securityfocus.com/bid/30748 · Exploit
• 🔥 https://exploit-db.com/exploits/32279 · Exploit
• 🔥 http://gulftech.org/?node=research&article_id=00126-08192008 · Exploit
• http://secunia.com/advisories/31527 · Vendor Advisory
• http://lussumo.com/community/discussion/8559/vanilla-115-release-candidate-1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2008-3758 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44554 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3758 · Note
• http://lussumo.com/docs/doku.php?id=vanilla:releasenotes · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44556 · Note
• http://securityreason.com/securityalert/4176 · Note
• http://securityfocus.com/archive/1/495577/100/0/threaded · Note