CVE-2004-1863

Multiple cross-site scripting (XSS) vulnerabilities in XMB (aka extreme message board) 1.9 beta (aka Nexus beta) allow remote attackers to inject arbitrary web script or HTML via (1) the u2uheader parameter in editprofile.php, the restrict parameter in (2) member.php, (3) misc.php, and (4) today.php, and (5) an arbitrary parameter in phpinfo.php.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/bid/9983
http://www.osvdb.org/14982
http://www.osvdb.org/14989
http://www.osvdb.org/14991
http://www.osvdb.org/16884
http://marc.info/?l=bugtraq&m=108032355905265&w=2
https://exchange.xforce.ibmcloud.com/vulnerabilities/15654
https://docs.xmbforum2.com/index.php?title=Security_Issue_History

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:xmb_forum:xmb:1.8_sp3:::::::*
	cpe:2.3:a:xmb_forum:xmb:1.9_beta:::::::*

Information

Published : 2004-12-30 21:00

Updated : 2021-04-29 08:15

NVD link : CVE-2004-1863

Mitre link : CVE-2004-1863

JSON object : View

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Advertisement

Products Affected

xmb_forum

xmb

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.securityfocus.com/bid/9983", "name": "9983", "tags": [], "refsource": "BID"}, {"url": "http://www.osvdb.org/14982", "name": "14982", "tags": [], "refsource": "OSVDB"}, {"url": "http://www.osvdb.org/14989", "name": "14989", "tags": [], "refsource": "OSVDB"}, {"url": "http://www.osvdb.org/14991", "name": "14991", "tags": [], "refsource": "OSVDB"}, {"url": "http://www.osvdb.org/16884", "name": "16884", "tags": [], "refsource": "OSVDB"}, {"url": "http://marc.info/?l=bugtraq&m=108032355905265&w=2", "name": "20040326 [waraxe-2004-SA#012 - Multiple vulnerabilities in XMB Forum 1.8 Partagium SP3 and 1.9 Nexus Beta]", "tags": [], "refsource": "BUGTRAQ"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15654", "name": "xmb-forum-multiple-xss(15654)", "tags": [], "refsource": "XF"}, {"url": "https://docs.xmbforum2.com/index.php?title=Security_Issue_History", "name": "https://docs.xmbforum2.com/index.php?title=Security_Issue_History", "tags": [], "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in XMB (aka extreme message board) 1.9 beta (aka Nexus beta) allow remote attackers to inject arbitrary web script or HTML via (1) the u2uheader parameter in editprofile.php, the restrict parameter in (2) member.php, (3) misc.php, and (4) today.php, and (5) an arbitrary parameter in phpinfo.php."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-79"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2004-1863", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}}, "publishedDate": "2004-12-31T05:00Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:xmb_forum:xmb:1.8_sp3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:xmb_forum:xmb:1.9_beta:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2021-04-29T15:15Z"}