CVE-2007-6700

Cross-site scripting (XSS) vulnerability in cgi-bin/bgplg in the web interface for the BGPD daemon in OpenBSD 4.1 allows remote attackers to inject arbitrary web script or HTML via the cmd parameter.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/archive/1/487369/100/0/threaded	Exploit
http://www.mail-archive.com/misc@openbsd.org/msg49057.html
http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/bgplg/bgplg.c	Patch
http://www.securityfocus.com/bid/27535	Patch
http://secunia.com/advisories/28726	Patch
http://www.securitytracker.com/id?1019288
http://www.securityfocus.com/archive/1/487350/100/0/threaded

Configurations

Configuration 1 (hide)

cpe:2.3:o:openbsd:openbsd:4.1:*:*:*:*:*:*:*

Information

Published : 2008-02-04 18:00

Updated : 2018-10-30 09:25

NVD link : CVE-2007-6700

Mitre link : CVE-2007-6700

JSON object : View

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Products Affected

openbsd

openbsd

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.securityfocus.com/archive/1/487369/100/0/threaded", "name": "20080131 Re: [DSECRG-08-007] OpenBSD BGPD daemon Web Interface XSS.", "tags": ["Exploit"], "refsource": "BUGTRAQ"}, {"url": "http://www.mail-archive.com/misc@openbsd.org/msg49057.html", "name": "[misc] 20071010 OpenBSD XSS ;)", "tags": [], "refsource": "MLIST"}, {"url": "http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/bgplg/bgplg.c", "name": "http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/bgplg/bgplg.c", "tags": ["Patch"], "refsource": "CONFIRM"}, {"url": "http://www.securityfocus.com/bid/27535", "name": "27535", "tags": ["Patch"], "refsource": "BID"}, {"url": "http://secunia.com/advisories/28726", "name": "28726", "tags": ["Patch"], "refsource": "SECUNIA"}, {"url": "http://www.securitytracker.com/id?1019288", "name": "1019288", "tags": [], "refsource": "SECTRACK"}, {"url": "http://www.securityfocus.com/archive/1/487350/100/0/threaded", "name": "20080131 [DSECRG-08-007] OpenBSD BGPD daemon Web Interface XSS.", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in cgi-bin/bgplg in the web interface for the BGPD daemon in OpenBSD 4.1 allows remote attackers to inject arbitrary web script or HTML via the cmd parameter."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-79"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2007-6700", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}}, "publishedDate": "2008-02-05T02:00Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:openbsd:openbsd:4.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-30T16:25Z"}

4.3 /10