PT-2011-1983 · Joomla · Jcomments

Published 2011-11-23 · Updated 2018-10-10 · CVE-2010-5048

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions JComments (com jcomments) component version 2.1.0.0 for Joomla!

Description The issue is related to a cross-site scripting (XSS) vulnerability. It allows remote authenticated users to inject arbitrary web script or HTML via the name parameter to "index.php".

Recommendations For JComments (com jcomments) component version 2.1.0.0, avoid using the name parameter in the affected "index.php" until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2010-5048

Affected Products

Jcomments

References · 8

• 🔥 http://securityfocus.com/bid/40230 · Exploit
• 🔥 http://htbridge.ch/advisory/xss_vulnerability_in_jcomments_joomla.html · Exploit
• 🔥 https://exploit-db.com/exploits/33998 · Exploit
• http://secunia.com/advisories/39842 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-5048 · Security Note
• http://joomlatune.com/jcomments-v.2.2-release-notes.html · Note
• http://securityfocus.com/archive/1/511320/100/0/threaded · Note
• http://packetstormsecurity.org/1005-exploits/joomlajcomments-xss.txt · Note