PT-2012-3540 · Kongreg8 · Kongreg8

Published 2012-03-19 · Updated 2017-08-29 · CVE-2012-1789

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Kongreg8 version 1.7.3

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The vulnerable parameters are surname and firstname in the "modules/members/addmember.php" endpoint, as well as groupdescription and groupname in the "modules/groups/addgroupform.php" endpoint.

Recommendations For Kongreg8 version 1.7.3, consider disabling the addmember.php and addgroupform.php modules until a patch is available to prevent exploitation through the surname, firstname, groupdescription, and groupname parameters. Restrict access to these modules to minimize the risk of XSS attacks. Avoid using the vulnerable parameters in the affected endpoints until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2012-1789

Affected Products

Kongreg8

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2012-1789 · Security Note
• http://securityfocus.com/bid/52178 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/73510 · Note
• http://archives.neohapsis.com/archives/bugtraq/2012-02/0154.html · Note