Lucene search

[email protected]CVE-2007-4595

HistoryAug 29, 2007 - 10:17 p.m.

CVE-2007-4595

2007-08-2922:17:00

CWE-79

[email protected]

web.nvd.nist.gov

mayaa

cross-site scripting

xss

vulnerability

web script

html

charset specification

meta element

utf-7

nvd

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.7 Medium

AI Score

Confidence

High

0.006 Low

EPSS

Percentile

78.9%

JSON

Cross-site scripting (XSS) vulnerability in Mayaa before 1.1.12 allows remote attackers to inject arbitrary web script or HTML in certain circumstances involving (1) lack of charset specification within a META element or (2) a META element that specifies an unrecognized charset, which trigger automatic character set recognition by the web browser, as demonstrated by improper handling of UTF-7 data.

Affected configurations

NVD

Node

the_seasar_foundationmayaaRange≤1.1.11

CPENameOperatorVersion
the_seasar_foundation:mayaathe seasar foundation mayaale1.1.11

CPE	Name	Operator	Version
the_seasar_foundation:mayaa	the seasar foundation mayaa	le	1.1.11

References

jvn.jp/jp/JVN%2338199598/index.html

mayaa.seasar.org/news/vulnerability20070816.html

osvdb.org/36655

secunia.com/advisories/26597

www.securityfocus.com/bid/25443

exchange.xforce.ibmcloud.com/vulnerabilities/36269

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.7 Medium

AI Score

Confidence

High

0.006 Low

EPSS

Percentile

78.9%

JSON

Related for CVE-2007-4595

nvd1 prion1 cvelist1