CVE-2005-2338

Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 2.0.12 JP and earlier, XOOPS 2.0.13.1 and earlier, and 2.2.x up to 2.2.3 RC1 allow remote attackers to inject arbitrary web script or HTML via (1) modules that use "XOOPS Code" and (2) newbb in the forum module.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://jvn.jp/jp/JVN%2377105349/index.html
http://marc.info/?l=bugtraq&m=113027315412024&w=2
http://secunia.com/advisories/17300	Patch Vendor Advisory
http://www.kb.cert.org/vuls/id/346302	US Government Resource
http://www.kb.cert.org/vuls/id/683958	US Government Resource
http://www.lac.co.jp/business/sns/intelligence/SNSadvisory_e/85_e.html	Patch Vendor Advisory
http://www.securityfocus.com/bid/15195

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:xoops:xoops::::::::
	cpe:2.3:a:xoops:xoops::::::::
	cpe:2.3:a:xoops:xoops::::::::

History

No history.

Information

Published : 2005-10-27 01:02

Updated : 2023-12-10 10:28

NVD link : CVE-2005-2338

Mitre link : CVE-2005-2338

CVE.ORG link : CVE-2005-2338

JSON object : View

Products Affected

xoops

xoops

CWE

NVD-CWE-Other

{"id": "CVE-2005-2338", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2005-10-27T01:02:00.000", "references": [{"url": "http://jvn.jp/jp/JVN%2377105349/index.html", "source": "cret@cert.org"}, {"url": "http://marc.info/?l=bugtraq&m=113027315412024&w=2", "source": "cret@cert.org"}, {"url": "http://secunia.com/advisories/17300", "tags": ["Patch", "Vendor Advisory"], "source": "cret@cert.org"}, {"url": "http://www.kb.cert.org/vuls/id/346302", "tags": ["US Government Resource"], "source": "cret@cert.org"}, {"url": "http://www.kb.cert.org/vuls/id/683958", "tags": ["US Government Resource"], "source": "cret@cert.org"}, {"url": "http://www.lac.co.jp/business/sns/intelligence/SNSadvisory_e/85_e.html", "tags": ["Patch", "Vendor Advisory"], "source": "cret@cert.org"}, {"url": "http://www.securityfocus.com/bid/15195", "source": "cret@cert.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 2.0.12 JP and earlier, XOOPS 2.0.13.1 and earlier, and 2.2.x up to 2.2.3 RC1 allow remote attackers to inject arbitrary web script or HTML via (1) modules that use \"XOOPS Code\" and (2) newbb in the forum module."}], "lastModified": "2016-10-18T03:26:18.853", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:xoops:xoops:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8C02065E-81F9-481B-9281-0BDCCA45A1AF", "versionEndIncluding": "2.0.12_jp"}, {"criteria": "cpe:2.3:a:xoops:xoops:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "06420D72-2A5F-4044-8DA7-7D7261CF16B1", "versionEndIncluding": "2.0.13.1"}, {"criteria": "cpe:2.3:a:xoops:xoops:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6C48026D-6730-4C27-9B0C-279797D8156C", "versionEndIncluding": "2.2.3_rc1"}], "operator": "OR"}]}], "sourceIdentifier": "cret@cert.org"}