PT-2011-1456 · Rocomotion · Rocomotion P Forum+7

Published 2011-01-20 · Updated 2020-08-26 · CVE-2010-3931

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Rocomotion P board versions 1.18 and earlier Rocomotion P forum versions 1.30 and earlier Rocomotion P up board versions 1.38 and earlier Rocomotion P diary R versions 1.13 and earlier Rocomotion P link versions 1.11 and earlier Rocomotion P link compact versions 1.04 and earlier Rocomotion pplog versions 3.31 and earlier Rocomotion pplog2 versions 3.37 and earlier Rocomotion PM bbs versions 1.07 and earlier Rocomotion PM up bbs versions 1.08 and earlier Rocomotion PM forum versions 1.18 and earlier

Description A cross-site scripting (XSS) issue affects multiple Rocomotion products, allowing remote attackers to inject arbitrary web script or HTML. The exact vectors used for the attack are not specified.

Recommendations For Rocomotion P board versions 1.18 and earlier, update to a version that includes a fix for this issue. For Rocomotion P forum versions 1.30 and earlier, update to a version that includes a fix for this issue. For Rocomotion P up board versions 1.38 and earlier, update to a version that includes a fix for this issue. For Rocomotion P diary R versions 1.13 and earlier, update to a version that includes a fix for this issue. For Rocomotion P link versions 1.11 and earlier, update to a version that includes a fix for this issue. For Rocomotion P link compact versions 1.04 and earlier, update to a version that includes a fix for this issue. For Rocomotion pplog versions 3.31 and earlier, update to a version that includes a fix for this issue. For Rocomotion pplog2 versions 3.37 and earlier, update to a version that includes a fix for this issue. For Rocomotion PM bbs versions 1.07 and earlier, update to a version that includes a fix for this issue. For Rocomotion PM up bbs versions 1.08 and earlier, update to a version that includes a fix for this issue. For Rocomotion PM forum versions 1.18 and earlier, update to a version that includes a fix for this issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2010-3931

Affected Products

Rocomotion P Board

Rocomotion P Diary R

Rocomotion P Forum

Rocomotion P Link

Rocomotion P Link Compact

Rocomotion Pm Bbs

Rocomotion Pplog

Rocomotion Pplog2

References · 8

• http://another.rocomotion.jp/12949466953653.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-3931 · Security Note
• http://jvn.jp/en/jp/JVN09115481/index.html · Note
• http://secunia.com/advisories/42957 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64745 · Note
• http://securityfocus.com/bid/45838 · Note
• http://osvdb.org/70495 · Note
• http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-000006.html · Note