CVE-2013-1636

2014-03-1214:55:00

CWE-79

[email protected]

web.nvd.nist.gov

cve-2013-1636

cross-site scripting

xss

open-flash-chart.swf

open flash chart

pretty link lite

wordpress

jnews

com_jnews

joomla!

civicrm

nvd

5.7 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.012 Low

EPSS

Percentile

85.1%

JSON

Cross-site scripting (XSS) vulnerability in open-flash-chart.swf in Open Flash Chart (aka Open-Flash Chart), as used in the Pretty Link Lite plugin before 1.6.3 for WordPress, JNews (com_jnews) component 8.0.1 for Joomla!, and CiviCRM 3.1.0 through 4.2.9 and 4.3.0 through 4.3.3, allows remote attackers to inject arbitrary web script or HTML via the get-data parameter.

CPENameOperatorVersion
blair_williams:pretty_link_liteblair williams pretty link liteeq1.6.1
blair_williams:pretty_link_liteblair williams pretty link liteeq1.6.0
blair_williams:pretty_link_liteblair williams pretty link litele1.6.2
joobi:com_jnewsjoobi com jnewseq8.0.1
civicrm:civicrmcivicrmeq3.1.3
civicrm:civicrmcivicrmeq4.2.5
civicrm:civicrmcivicrmeq3.1.0
civicrm:civicrmcivicrmeq4.1.2
civicrm:civicrmcivicrmeq4.3.1
civicrm:civicrmcivicrmeq4.1.4

CPE	Name	Operator	Version
blair_williams:pretty_link_lite	blair williams pretty link lite	eq	1.6.1
blair_williams:pretty_link_lite	blair williams pretty link lite	eq	1.6.0
blair_williams:pretty_link_lite	blair williams pretty link lite	le	1.6.2
joobi:com_jnews	joobi com jnews	eq	8.0.1
civicrm:civicrm	civicrm	eq	3.1.3
civicrm:civicrm	civicrm	eq	4.2.5
civicrm:civicrm	civicrm	eq	3.1.0
civicrm:civicrm	civicrm	eq	4.1.2
civicrm:civicrm	civicrm	eq	4.3.1
civicrm:civicrm	civicrm	eq	4.1.4