PT-2011-2893 · Simple Machines · Simple Machines Forum

Norv · Published 2011-06-21 · Updated 2011-06-29 · CVE-2011-1129

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Simple Machines Forum (SMF) versions prior to 1.1.13 Simple Machines Forum (SMF) versions 2.x prior to 2.0 RC5

Description A cross-site scripting (XSS) issue exists in the EditNews function in ManageNews.php. This could allow remote authenticated users to inject arbitrary web script or HTML via a save items action.

Recommendations For versions prior to 1.1.13, update to version 1.1.13 or later. For versions 2.x prior to 2.0 RC5, update to version 2.0 RC5 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2011-1129

Affected Products

Simple Machines Forum

References · 6

• http://openwall.com/lists/oss-security/2011/03/02/4 · Patch
• http://openwall.com/lists/oss-security/2011/02/22/17 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2011-1129 · Security Note
• http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip · Patch
• http://simplemachines.org/community/index.php?topic=421547.0 · Patch
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1129 · Note