PT-2020-7071 · Microsoft+1 · Internet Explorer+1

Published 2020-03-13 · Updated 2020-03-18 · CVE-2009-5159

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Invision Power Board (aka IPB or IP.Board) versions 2.x through 3.0.4

Description The issue allows for cross-site scripting (XSS) via a .txt attachment when Internet Explorer 5 is used.

Recommendations For Invision Power Board (aka IPB or IP.Board) versions 2.x through 3.0.4, consider disabling the handling of .txt attachments as a temporary workaround until a patch is available. Restrict access to the affected functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2009-5159

Affected Products

Internet Explorer

Invision Power Board

References · 7

• 🔥 https://exploit-db.com/exploits/33394 · Exploit
• 🔥 https://packetstormsecurity.com/files/83624/Invision-Power-Board-3.0.4-Cross-Site-Scripting.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-5159 · Security Note
• http://community.invisionpower.com/topic/300051-invision-power-board-305-released · Vendor Advisory
• https://securityfocus.com/bid/37263/info · Note
• https://t.me/cvenotify/1631 · Telegram Post
• https://t.me/cibsecurity/10496 · Telegram Post