Lucene search

K
cveMitreCVE-2007-5112
HistorySep 26, 2007 - 11:17 p.m.

CVE-2007-5112

2007-09-2623:17:00
CWE-79
mitre
web.nvd.nist.gov
17
cve-2007-5112
cross-site scripting
xss
google urchin 5
session.cgi
login page
web script injection
html injection
query string vulnerability
auto-completed passwords

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.4

Confidence

High

EPSS

0.02

Percentile

89.2%

Cross-site scripting (XSS) vulnerability in session.cgi (aka the login page) in Google Urchin 5 5.7.03 and earlier allows remote attackers to inject arbitrary web script or HTML via the query string, a different vulnerability than CVE-2007-4713. NOTE: this can be leveraged to capture login credentials in some browsers that support remembered (auto-completed) passwords.

Affected configurations

Nvd
Node
roi_revolutionurchinRange5.7.03
VendorProductVersionCPE
roi_revolutionurchin*cpe:2.3:a:roi_revolution:urchin:*:*:*:*:*:*:*:*

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.4

Confidence

High

EPSS

0.02

Percentile

89.2%

Related for CVE-2007-5112