PT-2010-3665 · Joomla · Com Activehelper Livehelp

Published 2010-05-25 · Updated 2010-05-26 · CVE-2010-2046

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions com activehelper livehelp version 2.0.3

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically, the DOMAINID parameter to "server/cookies.php" and the SERVER parameter to "server/index.php" are vulnerable.

Recommendations For version 2.0.3, consider disabling access to the "server/cookies.php" and "server/index.php" endpoints until a patch is available. Restrict the use of the DOMAINID and SERVER parameters to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2010-2046

Affected Products

Com Activehelper Livehelp

References · 6

• 🔥 http://packetstormsecurity.org/1005-exploits/joomlaactivehelper-xss.txt · Exploit
• 🔥 http://xenuser.org/2010/05/19/joomla-component-activehelper-livehelp-xss-vulnerabilities · Exploit
• 🔥 http://xenuser.org/documents/security/joomla_com_activehelper_livehelp_xss.txt · Exploit
• http://secunia.com/advisories/39870 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-2046 · Security Note
• http://securityfocus.com/bid/40278 · Note