Lucene search

[email protected]CVE-2006-6040

HistoryNov 22, 2006 - 12:07 a.m.

CVE-2006-6040

2006-11-2200:07:00

[email protected]

web.nvd.nist.gov

xss

jelsoft vbulletin 3.6.x

admincp

web script injection

html injection

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

5.8 Medium

AI Score

Confidence

High

0.037 Low

EPSS

Percentile

91.8%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in admincp/index.php in Jelsoft vBulletin 3.6.x allow remote attackers to inject arbitrary web script or HTML via (1) the prefs parameter in a buildnavprefs action or (2) the navprefs parameter in a savenavprefs action.

Affected configurations

NVD

Node

jelsoftvbulletinMatch3.6.0

jelsoftvbulletinMatch3.6.1

jelsoftvbulletinMatch3.6.2

jelsoftvbulletinMatch3.6.3

CPENameOperatorVersion
jelsoft:vbulletinjelsoft vbulletineq3.6.0
jelsoft:vbulletinjelsoft vbulletineq3.6.1
jelsoft:vbulletinjelsoft vbulletineq3.6.2
jelsoft:vbulletinjelsoft vbulletineq3.6.3

CPE	Name	Operator	Version
jelsoft:vbulletin	jelsoft vbulletin	eq	3.6.0
jelsoft:vbulletin	jelsoft vbulletin	eq	3.6.1
jelsoft:vbulletin	jelsoft vbulletin	eq	3.6.2
jelsoft:vbulletin	jelsoft vbulletin	eq	3.6.3

References

secunia.com/advisories/23011

securityreason.com/securityalert/1903

www.securityfocus.com/archive/1/451959/100/0/threaded

www.securityfocus.com/bid/21157

www.vbulletin.com/forum/showthread.php?postid=1256434

www.vupen.com/english/advisories/2006/4599

exchange.xforce.ibmcloud.com/vulnerabilities/30408

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

5.8 Medium

AI Score

Confidence

High

0.037 Low

EPSS

Percentile

91.8%

JSON

Related for CVE-2006-6040

cvelist2 nvd2 cve1 prion1