Lucene search

[email protected]CVE-2012-1039

HistoryMar 19, 2012 - 7:55 p.m.

CVE-2012-1039

2012-03-1919:55:03

CWE-79

[email protected]

web.nvd.nist.gov

cve-2012-1039

cross-site scripting

xss

dotclear

security vulnerabilities

remote attacks

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.8 Medium

AI Score

Confidence

High

0.01 Low

EPSS

Percentile

83.9%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in Dotclear before 2.4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) login_data parameter to admin/auth.php; (2) nb parameter to admin/blogs.php; (3) type, (4) sortby, (5) order, or (6) status parameters to admin/comments.php; or (7) page parameter to admin/plugin.php.

Affected configurations

NVD

Node

dotcleardotclearRange≤2.3.1

dotcleardotclearMatch1.2.1

dotcleardotclearMatch1.2.2

dotcleardotclearMatch1.2.3

dotcleardotclearMatch1.2.4

dotcleardotclearMatch1.2.5

dotcleardotclearMatch1.2.6

dotcleardotclearMatch1.2.7

dotcleardotclearMatch1.2.8

dotcleardotclearMatch2.0

dotcleardotclearMatch2.0beta_2

dotcleardotclearMatch2.0beta_3

dotcleardotclearMatch2.0beta_4

dotcleardotclearMatch2.0beta_5.2

dotcleardotclearMatch2.0beta_5.4

dotcleardotclearMatch2.0beta_6

dotcleardotclearMatch2.0beta_7

dotcleardotclearMatch2.0rc1

dotcleardotclearMatch2.0rc2

dotcleardotclearMatch2.0.1

dotcleardotclearMatch2.0.2

dotcleardotclearMatch2.1

dotcleardotclearMatch2.1.1

dotcleardotclearMatch2.1.3

dotcleardotclearMatch2.1.4

dotcleardotclearMatch2.1.5

dotcleardotclearMatch2.1.6

dotcleardotclearMatch2.1.7

dotcleardotclearMatch2.2

dotcleardotclearMatch2.2.1

dotcleardotclearMatch2.2.2

dotcleardotclearMatch2.2.3

dotcleardotclearMatch2.3.0

CPENameOperatorVersion
dotclear:dotcleardotclearle2.3.1
dotclear:dotcleardotcleareq1.2.1
dotclear:dotcleardotcleareq1.2.2
dotclear:dotcleardotcleareq1.2.3
dotclear:dotcleardotcleareq1.2.4
dotclear:dotcleardotcleareq1.2.5
dotclear:dotcleardotcleareq1.2.6
dotclear:dotcleardotcleareq1.2.7
dotclear:dotcleardotcleareq1.2.8
dotclear:dotcleardotcleareq2.0

CPE	Name	Operator	Version
dotclear:dotclear	dotclear	le	2.3.1
dotclear:dotclear	dotclear	eq	1.2.1
dotclear:dotclear	dotclear	eq	1.2.2
dotclear:dotclear	dotclear	eq	1.2.3
dotclear:dotclear	dotclear	eq	1.2.4
dotclear:dotclear	dotclear	eq	1.2.5
dotclear:dotclear	dotclear	eq	1.2.6
dotclear:dotclear	dotclear	eq	1.2.7
dotclear:dotclear	dotclear	eq	1.2.8
dotclear:dotclear	dotclear	eq	2.0