PT-2023-9939 · Unknown · Ahmyi Rivettracker

Ahmyi · Published 2023-01-03 · Updated 2024-05-17 · CVE-2012-10002

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ahmyi RivetTracker (affected versions not specified)

Description A vulnerability was found in ahmyi RivetTracker, affecting the function changeColor of the file css.php. The manipulation of the argument set css leads to cross-site scripting. The attack can be launched remotely.

Recommendations To fix this issue, it is recommended to apply a patch named 45a0f33876d58cb7e4a0f17da149e58fc893b858. As a temporary workaround, consider disabling the changeColor function until a patch is available. Restrict access to the vulnerable file css.php to minimize the risk of exploitation. Avoid using the argument set css in the affected function until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2012-10002

Affected Products

Ahmyi Rivettracker

References · 7

• https://github.com/ahmyi/rivettracker/pull/1 · Patch
• https://github.com/ahmyi/rivettracker/commit/45a0f33876d58cb7e4a0f17da149e58fc893b858 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2012-10002 · Security Note
• https://t.me/cvenotify/41173 · Telegram Post
• https://vuldb.com/?ctiid.217267 · Note
• https://t.me/cibsecurity/55798 · Telegram Post
• https://vuldb.com/?id.217267 · Note