CVE-2006-4038

Multiple cross-site scripting (XSS) vulnerabilities in eintragen.php in GaesteChaos 0.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) gastname or (2) gastwohnort parameters.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/bid/19343	Exploit Third Party Advisory VDB Entry
http://secunia.com/advisories/21357	Permissions Required Third Party Advisory
http://www.vupen.com/english/advisories/2006/3155	Not Applicable
http://marc.info/?l=full-disclosure&m=115464286427745&w=2	Exploit Mailing List
https://exchange.xforce.ibmcloud.com/vulnerabilities/28219
http://www.securityfocus.com/archive/1/442205/100/200/threaded

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:chaossoft:gaestechaos:*:*:*:*:*:*:*:*

Information

Published : 2006-08-09 15:04

Updated : 2018-10-17 14:33

NVD link : CVE-2006-4038

Mitre link : CVE-2006-4038

JSON object : View

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Advertisement

Products Affected

chaossoft

gaestechaos

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.securityfocus.com/bid/19343", "name": "19343", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "refsource": "BID"}, {"url": "http://secunia.com/advisories/21357", "name": "21357", "tags": ["Permissions Required", "Third Party Advisory"], "refsource": "SECUNIA"}, {"url": "http://www.vupen.com/english/advisories/2006/3155", "name": "ADV-2006-3155", "tags": ["Not Applicable"], "refsource": "VUPEN"}, {"url": "http://marc.info/?l=full-disclosure&m=115464286427745&w=2", "name": "20060803 GaesteChaos <= 0.2 Multiple Vulnerabilities", "tags": ["Exploit", "Mailing List"], "refsource": "FULLDISC"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28219", "name": "gastechaos-eintragen-xss(28219)", "tags": [], "refsource": "XF"}, {"url": "http://www.securityfocus.com/archive/1/442205/100/200/threaded", "name": "20060803 GaesteChaos <= 0.2 Multiple Vulnerabilities", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in eintragen.php in GaesteChaos 0.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) gastname or (2) gastwohnort parameters."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-79"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2006-4038", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2006-08-09T22:04Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:chaossoft:gaestechaos:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "0.2"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-17T21:33Z"}