PT-2011-4790 · Lightneasy · Lightneasy

Published 2011-10-04 · Updated 2018-10-09 · CVE-2011-3978

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions LightNEasy version 3.2.4

Description The issue allows remote authenticated users to inject arbitrary web script or HTML via specific parameters in a sendcomment action for the news page. The vulnerable parameters are commentemail, commentmessage, and commentname.

Recommendations For LightNEasy version 3.2.4, consider restricting access to the sendcomment action for the news page until a fix is available, and avoid using the parameters commentemail, commentmessage, and commentname in this action to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2011-3978

Affected Products

Lightneasy

References · 9

• 🔥 http://lightneasy.org/punbb/viewtopic.php?id=1464 · Exploit
• 🔥 http://rul3z.de/advisories/SSCHADV2011-013.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2011-3978 · Security Note
• http://secunia.com/advisories/45955 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/69737 · Note
• http://osvdb.org/75262 · Note
• http://securityfocus.com/archive/1/519571/100/0/threaded · Note
• http://securityreason.com/securityalert/8407 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3978 · Note