Lucene search

[email protected]CVE-2005-3867

HistoryNov 29, 2005 - 11:03 a.m.

CVE-2005-3867

2005-11-2911:03:00

[email protected]

web.nvd.nist.gov

cve-2005-3867

cross-site scripting

xss vulnerability

revenuepilot search engine script

web script injection

html injection

remote code execution

nvd

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.9 Medium

AI Score

Confidence

High

0.006 Low

EPSS

Percentile

78.9%

JSON

Cross-site scripting (XSS) vulnerability in RevenuePilot Search Engine Script 1.2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the REQ parameter, which is used when performing a search.

Affected configurations

NVD

Node

wwwsearchsolutionsrevenuepilot_search_engine_scriptRange≤1.2.0

CPENameOperatorVersion
wwwsearchsolutions:revenuepilot_search_engine_scriptwwwsearchsolutions revenuepilot search engine scriptle1.2.0

CPE	Name	Operator	Version
wwwsearchsolutions:revenuepilot_search_engine_script	wwwsearchsolutions revenuepilot search engine script	le	1.2.0

References

pridels0.blogspot.com/2005/11/revenuepilot-search-engine-xss-vuln.html

secunia.com/advisories/17717

www.osvdb.org/21143

www.securityfocus.com/bid/15612

www.securityfocus.com/bid/16129

www.vupen.com/english/advisories/2005/2607

exchange.xforce.ibmcloud.com/vulnerabilities/23345

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.9 Medium

AI Score

Confidence

High

0.006 Low

EPSS

Percentile

78.9%

JSON

Related for CVE-2005-3867

cvelist1 nvd1