Lucene search

[email protected]CVE-2008-0547

HistoryFeb 01, 2008 - 8:00 p.m.

CVE-2008-0547

2008-02-0120:00:00

CWE-79

[email protected]

web.nvd.nist.gov

cve-2008-0547

xss

vulnerability

candypress

admin

utilities

confighelp.asp

web script

html

nvd

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.7 Medium

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

74.2%

JSON

Cross-site scripting (XSS) vulnerability in admin/utilities_ConfigHelp.asp in CandyPress (CP) 4.1.1.26, and probably earlier 4.x and 3.x versions, allows remote attackers to inject arbitrary web script or HTML via the helpfield parameter.

Affected configurations

NVD

Node

shoppingtreecandypress_storeMatch4.1

shoppingtreecandypress_storeMatch4.1.1.26

CPENameOperatorVersion
shoppingtree:candypress_storeshoppingtree candypress storeeq4.1
shoppingtree:candypress_storeshoppingtree candypress storeeq4.1.1.26

CPE	Name	Operator	Version
shoppingtree:candypress_store	shoppingtree candypress store	eq	4.1
shoppingtree:candypress_store	shoppingtree candypress store	eq	4.1.1.26

References

secunia.com/advisories/28662

securityreason.com/securityalert/3600

www.candypress.com/CPforum/forum_posts.asp?TID=10630&PN=1

www.securityfocus.com/archive/1/487058/100/0/threaded

www.securityfocus.com/bid/27454

www.vupen.com/english/advisories/2008/0314

exchange.xforce.ibmcloud.com/vulnerabilities/39940

www.exploit-db.com/exploits/4988

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.7 Medium

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

74.2%

JSON

Related for CVE-2008-0547

prion1 nvd1 cvelist1