CVE-2004-2509

Cross-site scripting (XSS) vulnerabilities in (1) calendar.php, (2) login.php, and (3) online.php in Infopop UBB.Threads 6.2.3 and 6.5 allow remote attackers to inject arbitrary web script or HTML via the Cat parameter.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://archives.neohapsis.com/archives/fulldisclosure/2004-12/0239.html	Exploit
http://www.securityfocus.com/bid/11900	Exploit
http://www.osvdb.org/12365	Patch
http://www.osvdb.org/12366	Patch
http://www.osvdb.org/12367	Patch
http://securitytracker.com/id?1012503	Exploit
http://secunia.com/advisories/13452	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/18432

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ubbcentral:ubb.threads:6.2.3:::::::*
	cpe:2.3:a:ubbcentral:ubb.threads:6.5:::::::*

Information

Published : 2004-12-30 21:00

Updated : 2017-07-10 18:31

NVD link : CVE-2004-2509

Mitre link : CVE-2004-2509

JSON object : View

CWE

NVD-CWE-Other

Advertisement

Products Affected

ubbcentral

ubb.threads

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://archives.neohapsis.com/archives/fulldisclosure/2004-12/0239.html", "name": "20041213 Multiple XSS Vulnerabilities in several UBB.Thread Versions", "tags": ["Exploit"], "refsource": "FULLDISC"}, {"url": "http://www.securityfocus.com/bid/11900", "name": "11900", "tags": ["Exploit"], "refsource": "BID"}, {"url": "http://www.osvdb.org/12365", "name": "12365", "tags": ["Patch"], "refsource": "OSVDB"}, {"url": "http://www.osvdb.org/12366", "name": "12366", "tags": ["Patch"], "refsource": "OSVDB"}, {"url": "http://www.osvdb.org/12367", "name": "12367", "tags": ["Patch"], "refsource": "OSVDB"}, {"url": "http://securitytracker.com/id?1012503", "name": "1012503", "tags": ["Exploit"], "refsource": "SECTRACK"}, {"url": "http://secunia.com/advisories/13452", "name": "13452", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/18432", "name": "ubbthreads-multiple-scripts-xss(18432)", "tags": [], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerabilities in (1) calendar.php, (2) login.php, and (3) online.php in Infopop UBB.Threads 6.2.3 and 6.5 allow remote attackers to inject arbitrary web script or HTML via the Cat parameter."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2004-2509", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2004-12-31T05:00Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:ubbcentral:ubb.threads:6.2.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ubbcentral:ubb.threads:6.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-07-11T01:31Z"}