Lucene search

MitreCVE-2004-2109

HistoryMay 27, 2005 - 4:00 a.m.

CVE-2004-2109

2005-05-2704:00:00

mitre

web.nvd.nist.gov

cve-2004-2109

cross-site scripting

xss

q-shop

security vulnerability

session id theft

remote attack

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

6.5

Confidence

High

EPSS

0.011

Percentile

84.1%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in (1) imagezoom.asp or (2) recommend.asp in Q-Shop allow remote attackers to execute arbitrary script and steal the user session ID via Javascript in a URL.

Affected configurations

Nvd

Node

quadcommq-shopMatch2.0

quadcommq-shopMatch2.1

quadcommq-shopMatch2.5

quadcommq-shopMatch2.5_beta

VendorProductVersionCPE
quadcommq-shop2.0cpe:2.3:a:quadcomm:q-shop:2.0:*:*:*:*:*:*:*
quadcommq-shop2.1cpe:2.3:a:quadcomm:q-shop:2.1:*:*:*:*:*:*:*
quadcommq-shop2.5cpe:2.3:a:quadcomm:q-shop:2.5:*:*:*:*:*:*:*
quadcommq-shop2.5_betacpe:2.3:a:quadcomm:q-shop:2.5_beta:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
quadcomm	q-shop	2.0	cpe:2.3:a:quadcomm:q-shop:2.0:::::::*
quadcomm	q-shop	2.1	cpe:2.3:a:quadcomm:q-shop:2.1:::::::*
quadcomm	q-shop	2.5	cpe:2.3:a:quadcomm:q-shop:2.5:::::::*
quadcomm	q-shop	2.5_beta	cpe:2.3:a:quadcomm:q-shop:2.5_beta:::::::*

References

marc.info/?l=bugtraq&m=107488132208229&w=2

secunia.com/advisories/10704

www.osvdb.org/3696

www.osvdb.org/3697

www.securityfocus.com/bid/9480

exchange.xforce.ibmcloud.com/vulnerabilities/14923

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

AI Score

6.5

Confidence

High

EPSS

0.011

Percentile

84.1%

JSON

Related for CVE-2004-2109