PT-2023-9944 · Madgicweb · Madgicweb Buddystream Plugin

Blackphantom · Published 2023-02-19 · Updated 2024-05-17 · CVE-2012-10007

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions madgicweb BuddyStream Plugin versions up to 3.2.7

Description A vulnerability was found in the madgicweb BuddyStream Plugin. It has been declared as problematic. The issue affects an unknown functionality of the file ShareBox.php. The manipulation of the content/link/shares argument leads to cross-site scripting. The attack can be launched remotely. Upgrading to version 3.2.8 is able to address this issue.

Recommendations For madgicweb BuddyStream Plugin versions up to 3.2.7, upgrade to version 3.2.8 to address the issue. As a temporary workaround, consider restricting access to the ShareBox.php file until the upgrade is applied. Avoid using the content/link/shares argument in the affected functionality until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2012-10007

Affected Products

Madgicweb Buddystream Plugin

References · 8

• https://github.com/madgicweb/buddystream/commit/7d5b9a89a27711aad76fd55ab4cc4185b545a1d0 · Patch
• https://github.com/madgicweb/buddystream/releases/tag/3.2.8 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2012-10007 · Security Note
• https://vuldb.com/?id.221479 · Note
• https://vuldb.com/?ctiid.221479 · Note
• https://t.me/cvenotify/44664 · Telegram Post
• https://t.me/cibsecurity/58510 · Telegram Post
• https://t.me/cvenotify/59365 · Telegram Post