Lucene search

MitreCVE-2008-3712

HistoryAug 19, 2008 - 7:41 p.m.

CVE-2008-3712

2008-08-1919:41:00

CWE-79

mitre

web.nvd.nist.gov

cve

2008

3712

xss

vulnerabilities

mambo

web script

html

remote attackers

nvd

CVSS2

2.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:N/C:N/I:P/A:N

AI Score

5.8

Confidence

High

EPSS

0.003

Percentile

69.7%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in Mambo 4.6.2 and 4.6.5, when register_globals is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) query string to mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php and the (2) mosConfig_sitename parameter to administrator/popups/index3pop.php.

Affected configurations

Nvd

Node

mambomamboMatch4.6.2

mambomamboMatch4.6.5

VendorProductVersionCPE
mambomambo4.6.2cpe:2.3:a:mambo:mambo:4.6.2:*:*:*:*:*:*:*
mambomambo4.6.5cpe:2.3:a:mambo:mambo:4.6.5:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
mambo	mambo	4.6.2	cpe:2.3:a:mambo:mambo:4.6.2:::::::*
mambo	mambo	4.6.5	cpe:2.3:a:mambo:mambo:4.6.5:::::::*

References

secunia.com/advisories/31528

securityreason.com/securityalert/4164

www.securityfocus.com/archive/1/495507/100/0/threaded

www.securityfocus.com/bid/30708

exchange.xforce.ibmcloud.com/vulnerabilities/44502

exchange.xforce.ibmcloud.com/vulnerabilities/44503

CVSS2

2.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:N/C:N/I:P/A:N

AI Score

5.8

Confidence

High

EPSS

0.003

Percentile

69.7%

JSON

Related for CVE-2008-3712