PT-2022-24983 · Gnuboard5 · Gnuboard5

Published 2022-11-12 · Updated 2024-09-19 · CVE-2022-3963

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions gnuboard5 versions prior to 5.5.8.2.1

Description A problem was found in the FAQ Key ID Handler component, specifically in the file bbs/faq.php. The issue arises from the manipulation of the fm id argument, leading to cross-site scripting. This can be exploited remotely.

Recommendations For versions prior to 5.5.8.2.1, upgrade to version 5.5.8.2.1 to address this issue. As a temporary workaround, consider restricting access to the bbs/faq.php file or disabling the FAQ Key ID Handler component until the upgrade is applied. Avoid using the fm id argument in the affected component until the issue is resolved.

Fix

Improper Neutralization

XSS

Weakness Enumeration

CWE-707

CWE-79

Related Identifiers

CVE-2022-3963

Affected Products

Gnuboard5

References · 6

• https://github.com/gnuboard/gnuboard5/commit/ba062ca5b62809106d5a2f7df942ffcb44ecb5a9 · Patch
• https://osv.dev/vulnerability/CVE-2022-3963 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3963 · Security Note
• https://t.me/cibsecurity/52903 · Telegram Post
• https://vuldb.com/?id.213540 · Note
• https://t.me/cvenotify/37580 · Telegram Post