PT-2010-5636 · Debian · Tdiary

Published 1970-01-01 · Updated 2010-03-03 · CVE-2010-0726

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions tdiary versions 2.2.2 and earlier

Description A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML, possibly related to the plugin tb url and plugin tb excerpt parameters. Multiple vulnerabilities in the tdiary package of Debian GNU/Linux can be exploited remotely, potentially disrupting the integrity of protected information.

Recommendations For tdiary versions 2.2.2 and earlier, consider disabling the tb-send.rb plugin until a patch is available. Restrict access to the plugin tb url and plugin tb excerpt parameters to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2015-01595

BDU:2015-01596

BDU:2015-01597

BDU:2015-01598

BDU:2015-01599

CVE-2010-0726

DSA-2009-1

Affected Products

Tdiary

References · 18

• http://secunia.com/advisories/38742 · Vendor Advisory
• http://tdiary.org/20100225.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-0726 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-0726 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2010-0726 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0726 · Security Note
• https://bdu.fstec.ru/vul/2015-01596 · Security Note
• https://bdu.fstec.ru/vul/2015-01595 · Security Note
• https://bdu.fstec.ru/vul/2015-01598 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2010-0726 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-01597 · Security Note
• https://bdu.fstec.ru/vul/2015-01599 · Security Note
• http://securityfocus.com/bid/38413 · Patch
• http://tdiary.svn.sourceforge.net/viewvc/tdiary/branches/Stable-2_2/plugin/tb-send.rb?r1=3238&r2=3573 · Note
• http://jvn.jp/en/jp/JVN73331060/index.html · Note