Lucene search

[email protected]CVE-2011-4920

HistoryJan 04, 2012 - 7:55 p.m.

CVE-2011-4920

2012-01-0419:55:00

CWE-79

[email protected]

web.nvd.nist.gov

cve-2011-4920

xss

e107

0.7.26

1.0.0

vulnerability

web script

html

nvd

6.3 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.003 Low

EPSS

Percentile

68.4%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in e107 0.7.26, and other versions before 1.0.0, allow remote attackers to inject arbitrary web script or HTML via the URL to (1) e107_images/thumb.php or (2) rate.php, (3) resend_name parameter to e107_admin/users.php, and (4) link BBCode in user signatures.

CPENameOperatorVersion
e107:e107e107eq0.7.26

CPE	Name	Operator	Version
e107:e107	e107	eq	0.7.26

References

osvdb.org/78047

osvdb.org/78048

osvdb.org/78049

secunia.com/advisories/46706

www.openwall.com/lists/oss-security/2012/01/04/3

www.securityfocus.com/bid/51253

exchange.xforce.ibmcloud.com/vulnerabilities/72010

exchange.xforce.ibmcloud.com/vulnerabilities/72104

6.3 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.003 Low

EPSS

Percentile

68.4%

JSON

Related for CVE-2011-4920

cvelist1 prion1