CVE-2006-3795

Multiple cross-site scripting (XSS) vulnerabilities in DeluxeBB before 1.08 allow remote attackers to inject arbitrary web script or HTML via the (1) membercookie cookie in header.php and the (2) redirect parameter in misc.php.

CVSS v2.0 2.6 LOW

2.6^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:H/Au:N/C:N/I:P/A:N

Exploitability : 4.9 / Impact : 2.9

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/bid/19052
http://secunia.com/advisories/21116	Vendor Advisory
http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047989.html
http://securityreason.com/securityalert/1254
http://www.vupen.com/english/advisories/2006/2879
https://exchange.xforce.ibmcloud.com/vulnerabilities/27837
https://exchange.xforce.ibmcloud.com/vulnerabilities/27836
http://www.securityfocus.com/archive/1/440435/100/0/threaded

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:deluxebb:deluxebb:*:*:*:*:*:*:*:*

Information

Published : 2006-07-24 05:19

Updated : 2018-10-17 14:30

NVD link : CVE-2006-3795

Mitre link : CVE-2006-3795

JSON object : View

CWE

NVD-CWE-Other

Advertisement

Products Affected

deluxebb

deluxebb

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.securityfocus.com/bid/19052", "name": "19052", "tags": [], "refsource": "BID"}, {"url": "http://secunia.com/advisories/21116", "name": "21116", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2006-July/047989.html", "name": "20060718 Advisory : DeluxeBB mutiple vulnerabilities", "tags": [], "refsource": "FULLDISC"}, {"url": "http://securityreason.com/securityalert/1254", "name": "1254", "tags": [], "refsource": "SREASON"}, {"url": "http://www.vupen.com/english/advisories/2006/2879", "name": "ADV-2006-2879", "tags": [], "refsource": "VUPEN"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27837", "name": "deluxebb-header-xss(27837)", "tags": [], "refsource": "XF"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27836", "name": "deluxebb-misc-xss(27836)", "tags": [], "refsource": "XF"}, {"url": "http://www.securityfocus.com/archive/1/440435/100/0/threaded", "name": "20060718 DeluxeBB mutiple vulnerabilities", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in DeluxeBB before 1.08 allow remote attackers to inject arbitrary web script or HTML via the (1) membercookie cookie in header.php and the (2) redirect parameter in misc.php."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2006-3795", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 2.6, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "HIGH", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "LOW", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}}, "publishedDate": "2006-07-24T12:19Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:deluxebb:deluxebb:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "1.07"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-17T21:30Z"}