CVE-2003-1543

Cross-site scripting (XSS) vulnerability in Bajie Http Web Server 0.95zxe, 0.95zxc, and possibly others, allows remote attackers to inject arbitrary web script or HTML via the query string, which is reflected in an error message.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.geocities.com/gzhangx/websrv/docs/security.html
http://www.lucaercoli.it/advs/bajie.txt	Exploit
http://www.securiteam.com/securitynews/5LP10009FC.html
http://www.securityfocus.com/bid/7344
http://securitytracker.com/id?1006428
http://secunia.com/advisories/8477	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/11687

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:bajie:java_http_server:0.95:zxc::::::
	cpe:2.3:a:bajie:java_http_server:0.95:zxe::::::

Information

Published : 2003-12-30 21:00

Updated : 2017-08-07 18:29

NVD link : CVE-2003-1543

Mitre link : CVE-2003-1543

JSON object : View

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Advertisement

Products Affected

bajie

java_http_server

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.geocities.com/gzhangx/websrv/docs/security.html", "name": "http://www.geocities.com/gzhangx/websrv/docs/security.html", "tags": [], "refsource": "MISC"}, {"url": "http://www.lucaercoli.it/advs/bajie.txt", "name": "http://www.lucaercoli.it/advs/bajie.txt", "tags": ["Exploit"], "refsource": "MISC"}, {"url": "http://www.securiteam.com/securitynews/5LP10009FC.html", "name": "http://www.securiteam.com/securitynews/5LP10009FC.html", "tags": [], "refsource": "MISC"}, {"url": "http://www.securityfocus.com/bid/7344", "name": "7344", "tags": [], "refsource": "BID"}, {"url": "http://securitytracker.com/id?1006428", "name": "1006428", "tags": [], "refsource": "SECTRACK"}, {"url": "http://secunia.com/advisories/8477", "name": "8477", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11687", "name": "bajie-error-message-xss(11687)", "tags": [], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in Bajie Http Web Server 0.95zxe, 0.95zxc, and possibly others, allows remote attackers to inject arbitrary web script or HTML via the query string, which is reflected in an error message."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-79"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2003-1543", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}}, "publishedDate": "2003-12-31T05:00Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:bajie:java_http_server:0.95:zxc:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:bajie:java_http_server:0.95:zxe:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-08-08T01:29Z"}