Lucene search
HistoryDec 17, 2005 - 12:03 a.m.
CVE-2005-4307
scarecrow
xss
vulnerability
forum
post
profile
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
6 Medium
AI Score
Confidence
High
0.01 Low
EPSS
Percentile
83.7%
Cross-site scripting (XSS) vulnerability in ScareCrow 2.13 and earlier allows remote attackers to inject arbitrary web script or HTML via the forum parameter to (1) forum.cgi and (2) post.cgi, or (3) the user parameter to profile.cgi.
Affected configurations
Node
jonathan_bravatascarecrowRange≤2.13
ORjonathan_bravatascarecrowMatch2.00_beta
ORjonathan_bravatascarecrowMatch2.01_beta
ORjonathan_bravatascarecrowMatch2.10
ORjonathan_bravatascarecrowMatch2.11
ORjonathan_bravatascarecrowMatch2.12
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
6 Medium
AI Score
Confidence
High
0.01 Low
EPSS
Percentile
83.7%
Related for CVE-2005-4307