Lucene search

[email protected]CVE-2005-4621

HistoryJan 06, 2006 - 11:00 a.m.

CVE-2005-4621

2006-01-0611:00:00

[email protected]

web.nvd.nist.gov

cve

2005

4621

xss

vulnerability

vbulletin

3.5.1

editavatar

page

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6 Medium

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

73.4%

JSON

Cross-site scripting (XSS) vulnerability in the editavatar page in vBulletin 3.5.1 allows remote attackers to inject arbitrary web script or HTML via a URL in the remote avatar url field, in which the URL generates a parsing error, and possibly requiring a trailing extension such as .jpg.

Affected configurations

NVD

Node

jelsoftvbulletinMatch1.0.1lite

jelsoftvbulletinMatch2.0.3

jelsoftvbulletinMatch2.0_rc2

jelsoftvbulletinMatch2.0_rc3

jelsoftvbulletinMatch2.2.0

jelsoftvbulletinMatch2.2.1

jelsoftvbulletinMatch2.2.2

jelsoftvbulletinMatch2.2.3

jelsoftvbulletinMatch2.2.4

jelsoftvbulletinMatch2.2.5

jelsoftvbulletinMatch2.2.6

jelsoftvbulletinMatch2.2.7

jelsoftvbulletinMatch2.2.8

jelsoftvbulletinMatch2.2.9

jelsoftvbulletinMatch2.3.0

jelsoftvbulletinMatch2.3.2

jelsoftvbulletinMatch2.3.3

jelsoftvbulletinMatch2.3.4

jelsoftvbulletinMatch2.3.8

jelsoftvbulletinMatch3.0

jelsoftvbulletinMatch3.0.1

jelsoftvbulletinMatch3.0.2

jelsoftvbulletinMatch3.0.3

jelsoftvbulletinMatch3.0.4

jelsoftvbulletinMatch3.0.5

jelsoftvbulletinMatch3.0.6

jelsoftvbulletinMatch3.0.7

jelsoftvbulletinMatch3.0.8

jelsoftvbulletinMatch3.0.9

jelsoftvbulletinMatch3.0.10

jelsoftvbulletinMatch3.0_beta_2

jelsoftvbulletinMatch3.0_beta_3

jelsoftvbulletinMatch3.0_beta_4

jelsoftvbulletinMatch3.0_beta_5

jelsoftvbulletinMatch3.0_beta_6

jelsoftvbulletinMatch3.0_beta_7

jelsoftvbulletinMatch3.0_gamma

jelsoftvbulletinMatch3.5.1

CPENameOperatorVersion
jelsoft:vbulletinjelsoft vbulletineq1.0.1
jelsoft:vbulletinjelsoft vbulletineq2.0.3
jelsoft:vbulletinjelsoft vbulletineq2.0_rc2
jelsoft:vbulletinjelsoft vbulletineq2.0_rc3
jelsoft:vbulletinjelsoft vbulletineq2.2.0
jelsoft:vbulletinjelsoft vbulletineq2.2.1
jelsoft:vbulletinjelsoft vbulletineq2.2.2
jelsoft:vbulletinjelsoft vbulletineq2.2.3
jelsoft:vbulletinjelsoft vbulletineq2.2.4
jelsoft:vbulletinjelsoft vbulletineq2.2.5

CPE	Name	Operator	Version
jelsoft:vbulletin	jelsoft vbulletin	eq	1.0.1
jelsoft:vbulletin	jelsoft vbulletin	eq	2.0.3
jelsoft:vbulletin	jelsoft vbulletin	eq	2.0_rc2
jelsoft:vbulletin	jelsoft vbulletin	eq	2.0_rc3
jelsoft:vbulletin	jelsoft vbulletin	eq	2.2.0
jelsoft:vbulletin	jelsoft vbulletin	eq	2.2.1
jelsoft:vbulletin	jelsoft vbulletin	eq	2.2.2
jelsoft:vbulletin	jelsoft vbulletin	eq	2.2.3
jelsoft:vbulletin	jelsoft vbulletin	eq	2.2.4
jelsoft:vbulletin	jelsoft vbulletin	eq	2.2.5

Rows per page:

1-10 of 381

References

pridels0.blogspot.com/2005/11/vbulletin-351-xss-vuln.html

www.osvdb.org/21373

www.securityfocus.com/bid/16128

www.vbulletin.com/forum/showthread.php?t=166391

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6 Medium

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

73.4%

JSON

Related for CVE-2005-4621

nvd1 cvelist1