Lucene search

MitreCVE-2006-3617

HistoryJul 18, 2006 - 3:46 p.m.

CVE-2006-3617

2006-07-1815:46:00

mitre

web.nvd.nist.gov

cve-2006-3617

xss

pblguestbook.php

pixelated by lev

pbl guestbook

web script

html

security vulnerability

remote attack

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

AI Score

5.2

Confidence

High

EPSS

0.237

Percentile

96.6%

JSON

Cross-site scripting (XSS) vulnerability in pblguestbook.php in Pixelated By Lev (PBL) Guestbook 1.32 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) name, (2) message (aka comments), (3) website, and (4) email parameters, which bypasses XSS protection mechanisms that check for SCRIPT tags but not others, as demonstrated by a javascript URI in an onMouseOver attribute and the src attribute in an iframe tag. NOTE: some vectors might overlap CVE-2006-2975, although the use of alternate manipulations makes it unclear.

Affected configurations

Nvd

Node

pixelated_by_levpixelated_by_lev_guestbookMatch1.32

VendorProductVersionCPE
pixelated_by_levpixelated_by_lev_guestbook1.32cpe:2.3:a:pixelated_by_lev:pixelated_by_lev_guestbook:1.32:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
pixelated_by_lev	pixelated_by_lev_guestbook	1.32	cpe:2.3:a:pixelated_by_lev:pixelated_by_lev_guestbook:1.32:::::::*

References

www.neosecurityteam.net/index.php?action=advisories&id=23

www.securityfocus.com/archive/1/439486/100/0/threaded

exchange.xforce.ibmcloud.com/vulnerabilities/27006

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

AI Score

5.2

Confidence

High

EPSS

0.237

Percentile

96.6%

JSON

Related for CVE-2006-3617