CVE-2005-2338

Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 2.0.12 JP and earlier, XOOPS 2.0.13.1 and earlier, and 2.2.x up to 2.2.3 RC1 allow remote attackers to inject arbitrary web script or HTML via (1) modules that use "XOOPS Code" and (2) newbb in the forum module.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.lac.co.jp/business/sns/intelligence/SNSadvisory_e/85_e.html	Patch Vendor Advisory
http://jvn.jp/jp/JVN%2377105349/index.html
http://www.kb.cert.org/vuls/id/683958	US Government Resource
http://www.kb.cert.org/vuls/id/346302	US Government Resource
http://secunia.com/advisories/17300	Patch Vendor Advisory
http://www.securityfocus.com/bid/15195
http://marc.info/?l=bugtraq&m=113027315412024&w=2

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:xoops:xoops::::::::
	cpe:2.3:a:xoops:xoops::::::::
	cpe:2.3:a:xoops:xoops::::::::

Information

Published : 2005-10-26 18:02

Updated : 2016-10-17 20:26

NVD link : CVE-2005-2338

Mitre link : CVE-2005-2338

JSON object : View

CWE

NVD-CWE-Other

Products Affected

xoops

xoops

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.lac.co.jp/business/sns/intelligence/SNSadvisory_e/85_e.html", "name": "http://www.lac.co.jp/business/sns/intelligence/SNSadvisory_e/85_e.html", "tags": ["Patch", "Vendor Advisory"], "refsource": "MISC"}, {"url": "http://jvn.jp/jp/JVN%2377105349/index.html", "name": "JVN#77105349", "tags": [], "refsource": "JVN"}, {"url": "http://www.kb.cert.org/vuls/id/683958", "name": "VU#683958", "tags": ["US Government Resource"], "refsource": "CERT-VN"}, {"url": "http://www.kb.cert.org/vuls/id/346302", "name": "VU#346302", "tags": ["US Government Resource"], "refsource": "CERT-VN"}, {"url": "http://secunia.com/advisories/17300", "name": "17300", "tags": ["Patch", "Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://www.securityfocus.com/bid/15195", "name": "15195", "tags": [], "refsource": "BID"}, {"url": "http://marc.info/?l=bugtraq&m=113027315412024&w=2", "name": "20051025 [SNS Advisory No.85] XOOPS Multiple Cross-site Scripting Vulnerabilities", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 2.0.12 JP and earlier, XOOPS 2.0.13.1 and earlier, and 2.2.x up to 2.2.3 RC1 allow remote attackers to inject arbitrary web script or HTML via (1) modules that use \"XOOPS Code\" and (2) newbb in the forum module."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2005-2338", "ASSIGNER": "cert@cert.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2005-10-27T01:02Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:xoops:xoops:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "2.0.12_jp"}, {"cpe23Uri": "cpe:2.3:a:xoops:xoops:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "2.0.13.1"}, {"cpe23Uri": "cpe:2.3:a:xoops:xoops:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "2.2.3_rc1"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2016-10-18T03:26Z"}

4.3 /10