CVE-2007-4745

Multiple cross-site scripting (XSS) vulnerabilities in the AkoBook 3.42 and earlier component (com_akobook) for Mambo allow remote attackers to inject arbitrary web script or HTML via Javascript events in the (1) gbmail and (2) gbpage parameters in the sign function.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://trew.icenetx.net/toolz/advisory-mambo-akobook-en.txt	Vendor Advisory
http://secunia.com/advisories/26706	Vendor Advisory
http://www.securityfocus.com/bid/25576
http://securityreason.com/securityalert/3101
http://osvdb.org/37533
http://www.vupen.com/english/advisories/2007/3080
https://exchange.xforce.ibmcloud.com/vulnerabilities/36471

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:mambo:mambo_site_server::::::::
	cpe:2.3:a:joomla:akobook:3.42:::::::*

Information

Published : 2007-09-06 15:17

Updated : 2017-07-28 18:33

NVD link : CVE-2007-4745

Mitre link : CVE-2007-4745

JSON object : View

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Advertisement

Products Affected

mambo

mambo_site_server

joomla

akobook

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://trew.icenetx.net/toolz/advisory-mambo-akobook-en.txt", "name": "http://trew.icenetx.net/toolz/advisory-mambo-akobook-en.txt", "tags": ["Vendor Advisory"], "refsource": "MISC"}, {"url": "http://secunia.com/advisories/26706", "name": "26706", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://www.securityfocus.com/bid/25576", "name": "25576", "tags": [], "refsource": "BID"}, {"url": "http://securityreason.com/securityalert/3101", "name": "3101", "tags": [], "refsource": "SREASON"}, {"url": "http://osvdb.org/37533", "name": "37533", "tags": [], "refsource": "OSVDB"}, {"url": "http://www.vupen.com/english/advisories/2007/3080", "name": "ADV-2007-3080", "tags": [], "refsource": "VUPEN"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36471", "name": "akobook-gb-xss(36471)", "tags": [], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in the AkoBook 3.42 and earlier component (com_akobook) for Mambo allow remote attackers to inject arbitrary web script or HTML via Javascript events in the (1) gbmail and (2) gbpage parameters in the sign function."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-79"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2007-4745", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}}, "publishedDate": "2007-09-06T22:17Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:mambo:mambo_site_server:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:joomla:akobook:3.42:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-07-29T01:33Z"}