Lucene search

[email protected]CVE-2008-1972

HistoryApr 27, 2008 - 6:05 p.m.

CVE-2008-1972

2008-04-2718:05:00

CWE-79

[email protected]

web.nvd.nist.gov

cve-2008-1972

cross-site scripting

xss vulnerabilities

exponent cms

user account creation

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.8 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

65.5%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in the user account creation feature in Exponent CMS 0.96.6-GA20071003 and earlier, when the Allow Registration? configuration option is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) username, (2) firstname, (3) lastname, and (4) e-mail address fields. NOTE: some of these details are obtained from third party information.

Affected configurations

NVD

Node

oicgroupexponent_cmsRange≤0.96.6-ga20071003

oicgroupexponent_cmsMatch0.94

oicgroupexponent_cmsMatch0.95

oicgroupexponent_cmsMatch0.96.1

oicgroupexponent_cmsMatch0.96.3

oicgroupexponent_cmsMatch0.96.4

oicgroupexponent_cmsMatch0.96.5rc1

oicgroupexponent_cmsMatch0.96.6

oicgroupexponent_cmsMatch0.96.6alpha

CPENameOperatorVersion
oicgroup:exponent_cmsoicgroup exponent cmsle0.96.6-ga20071003
oicgroup:exponent_cmsoicgroup exponent cmseq0.94
oicgroup:exponent_cmsoicgroup exponent cmseq0.95
oicgroup:exponent_cmsoicgroup exponent cmseq0.96.1
oicgroup:exponent_cmsoicgroup exponent cmseq0.96.3
oicgroup:exponent_cmsoicgroup exponent cmseq0.96.4
oicgroup:exponent_cmsoicgroup exponent cmseq0.96.5
oicgroup:exponent_cmsoicgroup exponent cmseq0.96.6

CPE	Name	Operator	Version
oicgroup:exponent_cms	oicgroup exponent cms	le	0.96.6-ga20071003
oicgroup:exponent_cms	oicgroup exponent cms	eq	0.94
oicgroup:exponent_cms	oicgroup exponent cms	eq	0.95
oicgroup:exponent_cms	oicgroup exponent cms	eq	0.96.1
oicgroup:exponent_cms	oicgroup exponent cms	eq	0.96.3
oicgroup:exponent_cms	oicgroup exponent cms	eq	0.96.4
oicgroup:exponent_cms	oicgroup exponent cms	eq	0.96.5
oicgroup:exponent_cms	oicgroup exponent cms	eq	0.96.6

References

secunia.com/advisories/29875

sourceforge.net/project/shownotes.php?release_id=592961&group_id=118524

www.exponentcms.org/index.php?action=view&id=64&module=newsmodule&src=%40random44fe03276195

www.securityfocus.com/bid/28834

exchange.xforce.ibmcloud.com/vulnerabilities/41878

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.8 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

65.5%

JSON

Related for CVE-2008-1972

prion1 nvd1 cvelist1