CVE-2009-0455

Опубликовано: 11 фев. 2009

Источник: nvd

CVSS2: 2.6

EPSS Низкий

Описание

Cross-site scripting (XSS) vulnerability in the anonymous comments feature in lib-comment.php in glFusion 1.1.0, 1.1.1, and earlier versions allows remote attackers to inject arbitrary web script or HTML via the username parameter to comment.php.

Ссылки

http://secunia.com/advisories/33878
Vendor Advisory
http://www.fortconsult.net/images/pdf/advisories/glFusion-xss-advisory.pdf
http://www.glfusion.org/article.php/xsscomments
Vendor Advisory
http://www.securityfocus.com/bid/33683
Exploit
Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/48603
http://secunia.com/advisories/33878
Vendor Advisory
http://www.fortconsult.net/images/pdf/advisories/glFusion-xss-advisory.pdf
http://www.glfusion.org/article.php/xsscomments
Vendor Advisory
http://www.securityfocus.com/bid/33683
Exploit
Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/48603

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:glfusion:glfusion:*:*:*:*:*:*:*:*

Версия до 1.1.1 (включая)

cpe:2.3:a:glfusion:glfusion:1.1.0:*:*:*:*:*:*:*

EPSS

Процентиль: 78%

0.01104

Низкий

2.6 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-vx7j-5c4x-j878

github

почти 4 года назад