PT-2012-2902 · Unknown · Webcalendar

Henri Salo · Published 2012-10-08 · Updated 2017-08-29 · CVE-2012-0846

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions WebCalendar version 1.2.4

Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the Location variable. This can lead to the execution of malicious scripts on the client-side.

Recommendations For WebCalendar version 1.2.4, update to a version that fixes this issue, as using the Location variable can lead to code injection. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2012-0846

Affected Products

Webcalendar

References · 10

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2012-01/0129.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-0846 · Security Note
• http://openwall.com/lists/oss-security/2012/02/11/2 · Note
• http://openwall.com/lists/oss-security/2012/02/12/1 · Note
• http://openwall.com/lists/oss-security/2012/02/13/6 · Note
• http://securityfocus.com/bid/51600 · Note
• http://sourceforge.net/tracker/?func=detail&aid=3488543&group_id=3870&atid=303870 · Note
• http://sourceforge.net/tracker/?func=detail&aid=3472745&group_id=3870&atid=103870 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/72563 · Note
• http://openwall.com/lists/oss-security/2012/02/12/3 · Note