CVE-2004-1692

Cross-site scripting (XSS) vulnerability in index.php in Mambo 4.5 (1.0.9) allows remote attackers to inject arbitrary web script or HTML via the (1) Itemid, (2) mosmsg, or (3) limit parameters.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://mamboforge.net/frs/shownotes.php?release_id=1672	Patch
http://www.securityfocus.com/bid/11220	Exploit Patch Vendor Advisory
http://www.osvdb.org/10179	Exploit Patch Vendor Advisory
http://marc.info/?l=bugtraq&m=109571849713158&w=2
https://exchange.xforce.ibmcloud.com/vulnerabilities/20616

Configurations

Configuration 1 (hide)

cpe:2.3:a:mambo:mambo_open_source:4.5_1.0.9:*:*:*:*:*:*:*

Information

Published : 2004-09-17 21:00

Updated : 2017-07-10 18:31

NVD link : CVE-2004-1692

Mitre link : CVE-2004-1692

JSON object : View

CWE

NVD-CWE-Other

Products Affected

mambo

mambo_open_source

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://mamboforge.net/frs/shownotes.php?release_id=1672", "name": "http://mamboforge.net/frs/shownotes.php?release_id=1672", "tags": ["Patch"], "refsource": "CONFIRM"}, {"url": "http://www.securityfocus.com/bid/11220", "name": "11220", "tags": ["Exploit", "Patch", "Vendor Advisory"], "refsource": "BID"}, {"url": "http://www.osvdb.org/10179", "name": "10179", "tags": ["Exploit", "Patch", "Vendor Advisory"], "refsource": "OSVDB"}, {"url": "http://marc.info/?l=bugtraq&m=109571849713158&w=2", "name": "20040918 Vulnerabilities in TUTOS", "tags": [], "refsource": "BUGTRAQ"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/20616", "name": "mambo-multiple-xss(20616)", "tags": [], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in index.php in Mambo 4.5 (1.0.9) allows remote attackers to inject arbitrary web script or HTML via the (1) Itemid, (2) mosmsg, or (3) limit parameters."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2004-1692", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2004-09-18T04:00Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:mambo:mambo_open_source:4.5_1.0.9:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-07-11T01:31Z"}

4.3 /10