CVE-2006-4038

Multiple cross-site scripting (XSS) vulnerabilities in eintragen.php in GaesteChaos 0.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) gastname or (2) gastwohnort parameters.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://marc.info/?l=full-disclosure&m=115464286427745&w=2	Exploit Mailing List
http://secunia.com/advisories/21357	Permissions Required Third Party Advisory
http://www.securityfocus.com/archive/1/442205/100/200/threaded
http://www.securityfocus.com/bid/19343	Exploit Third Party Advisory VDB Entry
http://www.vupen.com/english/advisories/2006/3155	Not Applicable
https://exchange.xforce.ibmcloud.com/vulnerabilities/28219

Configurations

Configuration 1 (hide)

cpe:2.3:a:chaossoft:gaestechaos:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2006-08-09 22:04

Updated : 2023-12-10 10:28

NVD link : CVE-2006-4038

Mitre link : CVE-2006-4038

CVE.ORG link : CVE-2006-4038

JSON object : View

Products Affected

chaossoft

gaestechaos

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2006-4038", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2006-08-09T22:04:00.000", "references": [{"url": "http://marc.info/?l=full-disclosure&m=115464286427745&w=2", "tags": ["Exploit", "Mailing List"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/21357", "tags": ["Permissions Required", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/442205/100/200/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/19343", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2006/3155", "tags": ["Not Applicable"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28219", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in eintragen.php in GaesteChaos 0.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) gastname or (2) gastwohnort parameters."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en eintragen.php en GaesteChaos 0.2 y anteriores permiten a atacantes remotos inyectar secuencias de c\u00f3digo web o HTML a trav\u00e9s de los par\u00e1metros (1) gastname o (2) gastwohnort."}], "lastModified": "2018-10-17T21:33:02.020", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:chaossoft:gaestechaos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2FEC2F48-6B26-4749-B95A-B76CB0FC4976", "versionEndIncluding": "0.2"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}