PT-2012-5053 · Open Constructor · Open Constructor

Published 2012-12-28 · Updated 2012-12-28 · CVE-2012-3870

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Open Constructor version 3.12.0

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML via the name or description parameter in the objects/createobject.php file.

Recommendations For Open Constructor version 3.12.0, avoid using the name and description parameters in the objects/createobject.php file until a fix is available. As a temporary workaround, consider validating and sanitizing user input for these parameters to prevent malicious script injection.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2012-3870

Affected Products

Open Constructor

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2012-3870 · Security Note
• http://packetstormsecurity.org/files/115276/Openconstructor-CMS-3.12.0-Cross-Site-Scripting.html · Note