PT-2015-4107 · Woltlab+1 · Woltlab Burning Board+1

Published 2015-01-15 · Updated 2018-10-09 · CVE-2014-8869

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions com.tapatalk.wbb4 plugin versions 1.x before 1.1.2 for Woltlab Burning Board 4.0

Description The issue allows remote attackers to inject arbitrary web script or HTML via the app android id or app kindle url parameters in the welcome.php file of the mobiquo/smartbanner module. This can lead to cross-site scripting (XSS) attacks.

Recommendations For com.tapatalk.wbb4 plugin versions 1.x before 1.1.2, update to version 1.1.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the welcome.php file in the mobiquo/smartbanner module to minimize the risk of exploitation. Avoid using the app android id and app kindle url parameters in the affected module until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-8869

Affected Products

Woltlab Burning Board

Com.Tapatalk.Wbb4

References · 6

• 🔥 http://seclists.org/fulldisclosure/2015/Jan/31 · Exploit
• 🔥 http://securityfocus.com/bid/71997 · Exploit
• 🔥 https://redteam-pentesting.de/en/advisories/rt-sa-2014-015/-cross-site-scripting-in-tapatalk-plugin-for-woltlab-burning-board-4-0 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-8869 · Security Note
• https://support.tapatalk.com/threads/tapatalk-for-woltlab-plugin-release-announcement-and-changelog.19540 · Vendor Advisory
• http://securityfocus.com/archive/1/534449/100/0/threaded · Note