CVE-2007-5426

Multiple cross-site scripting (XSS) vulnerabilities in ActiveKB NX 2.5.4 allow remote attackers to inject arbitrary web script or HTML via the page parameter to the default URI for some directories, as demonstrated by (1) ActiveKB/ and (2) default/categories/ActiveKB/.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://osvdb.org/37661
http://secunia.com/advisories/27194
http://securityreason.com/securityalert/3216
http://securityvulns.ru/Rdocument956.html	Exploit
http://www.securityfocus.com/archive/1/482006/100/0/threaded
http://www.securityfocus.com/bid/26027
https://exchange.xforce.ibmcloud.com/vulnerabilities/37066

Configurations

Configuration 1 (hide)

cpe:2.3:a:interspire:activekb_nx:2.5.4:*:*:*:*:*:*:*

History

No history.

Information

Published : 2007-10-12 23:17

Updated : 2023-12-10 10:40

NVD link : CVE-2007-5426

Mitre link : CVE-2007-5426

CVE.ORG link : CVE-2007-5426

JSON object : View

Products Affected

interspire

activekb_nx

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2007-5426", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2007-10-12T23:17:00.000", "references": [{"url": "http://osvdb.org/37661", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/27194", "source": "cve@mitre.org"}, {"url": "http://securityreason.com/securityalert/3216", "source": "cve@mitre.org"}, {"url": "http://securityvulns.ru/Rdocument956.html", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/482006/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/26027", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37066", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in ActiveKB NX 2.5.4 allow remote attackers to inject arbitrary web script or HTML via the page parameter to the default URI for some directories, as demonstrated by (1) ActiveKB/ and (2) default/categories/ActiveKB/."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en ActiveKB NX 2.5.4 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n a trav\u00e9s del par\u00e1metro page para el URI por defecto de algunos directorios, como se ha demostrado con (1) ActiveKB/ y (2) default/categories/ActiveKB/."}], "lastModified": "2018-10-15T21:44:43.827", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:interspire:activekb_nx:2.5.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "627CA781-D0D5-4C94-9DB5-2E177D0A972F"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}