CVE-2007-3135

Cross-site scripting (XSS) vulnerability in atomPhotoBlog.php in Atom Photoblog 1.0.9 and earlier allows remote attackers to inject arbitrary web script or HTML via the tag parameter.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://sourceforge.net/project/shownotes.php?group_id=186464&release_id=514101
http://www.secvsn.com/content/Advisories/sr-060607-atomphotoblog.html
http://www.securityfocus.com/bid/24363	Exploit
http://secunia.com/advisories/25562
http://securityreason.com/securityalert/2787
http://osvdb.org/37046
https://exchange.xforce.ibmcloud.com/vulnerabilities/34768
http://www.securityfocus.com/archive/1/470750/100/0/threaded

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:atom:photoblog:*:*:*:*:*:*:*:*

Information

Published : 2007-06-08 09:30

Updated : 2018-10-16 09:47

NVD link : CVE-2007-3135

Mitre link : CVE-2007-3135

JSON object : View

CWE

NVD-CWE-Other

Advertisement

Products Affected

atom

photoblog

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://sourceforge.net/project/shownotes.php?group_id=186464&release_id=514101", "name": "http://sourceforge.net/project/shownotes.php?group_id=186464&release_id=514101", "tags": [], "refsource": "MISC"}, {"url": "http://www.secvsn.com/content/Advisories/sr-060607-atomphotoblog.html", "name": "http://www.secvsn.com/content/Advisories/sr-060607-atomphotoblog.html", "tags": [], "refsource": "MISC"}, {"url": "http://www.securityfocus.com/bid/24363", "name": "24363", "tags": ["Exploit"], "refsource": "BID"}, {"url": "http://secunia.com/advisories/25562", "name": "25562", "tags": [], "refsource": "SECUNIA"}, {"url": "http://securityreason.com/securityalert/2787", "name": "2787", "tags": [], "refsource": "SREASON"}, {"url": "http://osvdb.org/37046", "name": "37046", "tags": [], "refsource": "OSVDB"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34768", "name": "atom-photoblog-tag-xss(34768)", "tags": [], "refsource": "XF"}, {"url": "http://www.securityfocus.com/archive/1/470750/100/0/threaded", "name": "20070607 Atom PhotoBlog v1.0.9 XSS vulnerability", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in atomPhotoBlog.php in Atom Photoblog 1.0.9 and earlier allows remote attackers to inject arbitrary web script or HTML via the tag parameter."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2007-3135", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}}, "publishedDate": "2007-06-08T16:30Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:atom:photoblog:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "1.0.9"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-16T16:47Z"}