CVE-2003-1238

Cross-site scripting vulnerability (XSS) in Nuked-Klan 1.3 beta and earlier allows remote attackers to steal authentication information via cookies by injecting arbitrary HTML or script into op of the (1) Team, (2) News, and (3) Liens modules.

CVSS v2.0 5.8 MEDIUM

5.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:N

Exploitability : 8.6 / Impact : 4.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://archives.neohapsis.com/archives/bugtraq/2003-02/0276.html	Exploit
http://archives.neohapsis.com/archives/bugtraq/2003-03/0275.html	Exploit
http://www.securityfocus.com/bid/6916	Exploit
http://www.iss.net/security_center/static/11420.php

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:nuked-klan:nuked-klan:1.2:::::::*
	cpe:2.3:a:nuked-klan:nuked-klan:1.3:::::::*
	cpe:2.3:a:nuked-klan:nuked-klan:1.3_beta:::::::*
	cpe:2.3:a:nuked-klan:nuked-klan:1.2_beta:::::::*

Information

Published : 2003-12-30 21:00

Updated : 2008-09-05 13:36

NVD link : CVE-2003-1238

Mitre link : CVE-2003-1238

JSON object : View

CWE

NVD-CWE-Other

Advertisement

Products Affected

nuked-klan

nuked-klan

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://archives.neohapsis.com/archives/bugtraq/2003-02/0276.html", "name": "20030221 [SCSA-006] XSS & Function Execution Vulnerabilities in Nuked-Klan", "tags": ["Exploit"], "refsource": "BUGTRAQ"}, {"url": "http://archives.neohapsis.com/archives/bugtraq/2003-03/0275.html", "name": "20030318 Some XSS vulns", "tags": ["Exploit"], "refsource": "BUGTRAQ"}, {"url": "http://www.securityfocus.com/bid/6916", "name": "6916", "tags": ["Exploit"], "refsource": "BID"}, {"url": "http://www.iss.net/security_center/static/11420.php", "name": "nuked-klan-team-xss(11420)", "tags": [], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Cross-site scripting vulnerability (XSS) in Nuked-Klan 1.3 beta and earlier allows remote attackers to steal authentication information via cookies by injecting arbitrary HTML or script into op of the (1) Team, (2) News, and (3) Liens modules."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2003-1238", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 5.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 4.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2003-12-31T05:00Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:nuked-klan:nuked-klan:1.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:nuked-klan:nuked-klan:1.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:nuked-klan:nuked-klan:1.3_beta:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:nuked-klan:nuked-klan:1.2_beta:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2008-09-05T20:36Z"}