Lucene search

[email protected]CVE-2008-1630

HistoryApr 02, 2008 - 5:44 p.m.

CVE-2008-1630

2008-04-0217:44:00

CWE-79

[email protected]

web.nvd.nist.gov

cve-2008-1630

security

xss

cuteflow 1.5.0

cuteflow 2.10.0

remote attackers

web script

html

injection

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.7 Medium

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

72.7%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in CuteFlow 1.5.0 and 2.10.0 allow remote attackers to inject arbitrary web script or HTML via the language parameter to (1) page/showcirculation.php; and (2) edittemplate_step2.php, (3) showfields.php, (4) showuser.php, (5) editmailinglist_step1.php, and (6) showtemplates.php in pages/.

Affected configurations

NVD

Node

emedia_office_gmbhcuteflowMatch1.5.0

emedia_office_gmbhcuteflowMatch2.10.0

CPENameOperatorVersion
emedia_office_gmbh:cuteflowemedia office gmbh cutefloweq1.5.0
emedia_office_gmbh:cuteflowemedia office gmbh cutefloweq2.10.0

CPE	Name	Operator	Version
emedia_office_gmbh:cuteflow	emedia office gmbh cuteflow	eq	1.5.0
emedia_office_gmbh:cuteflow	emedia office gmbh cuteflow	eq	2.10.0

References

secunia.com/advisories/29612

securityreason.com/securityalert/3792

www.securityfocus.com/archive/1/490305/100/0/threaded

www.securityfocus.com/bid/28500

exchange.xforce.ibmcloud.com/vulnerabilities/41537

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.7 Medium

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

72.7%

JSON

Related for CVE-2008-1630

exploitdb6 prion1 cvelist1 nvd1