CVE-2009-2131

Опубликовано: 19 июн. 2009

Источник: nvd

CVSS2: 3.5

EPSS Низкий

Описание

Cross-site scripting (XSS) vulnerability in 4images 1.7.7 and earlier allows remote authenticated users to inject arbitrary web script or HTML by providing a crafted user_homepage parameter to member.php, and then posting a comment associated with a picture.

Ссылки

http://osvdb.org/55092
Patch
http://secunia.com/advisories/35427
Vendor Advisory
http://www.4homepages.de/forum/index.php?topic=15186.0
Patch
Vendor Advisory
http://www.securityfocus.com/bid/35342
http://www.vupen.com/english/advisories/2009/1582
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/51090
https://www.exploit-db.com/exploits/8936
http://osvdb.org/55092
Patch
http://secunia.com/advisories/35427
Vendor Advisory
http://www.4homepages.de/forum/index.php?topic=15186.0
Patch
Vendor Advisory
http://www.securityfocus.com/bid/35342
http://www.vupen.com/english/advisories/2009/1582
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/51090
https://www.exploit-db.com/exploits/8936

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:4homepages:4images:*:*:*:*:*:*:*:*

Версия до 1.7.7 (включая)

cpe:2.3:a:4homepages:4images:1.0:rc-1:*:*:*:*:*:*

cpe:2.3:a:4homepages:4images:1.0:rc-2:*:*:*:*:*:*

cpe:2.3:a:4homepages:4images:1.5:*:*:*:*:*:*:*

cpe:2.3:a:4homepages:4images:1.6:*:*:*:*:*:*:*

cpe:2.3:a:4homepages:4images:1.6.1:*:*:*:*:*:*:*

cpe:2.3:a:4homepages:4images:1.7:*:*:*:*:*:*:*

cpe:2.3:a:4homepages:4images:1.7.1:*:*:*:*:*:*:*

cpe:2.3:a:4homepages:4images:1.7.2:*:*:*:*:*:*:*

cpe:2.3:a:4homepages:4images:1.7.3:*:*:*:*:*:*:*

cpe:2.3:a:4homepages:4images:1.7.4:*:*:*:*:*:*:*

cpe:2.3:a:4homepages:4images:1.7.5:*:*:*:*:*:*:*

cpe:2.3:a:4homepages:4images:1.7.6:*:*:*:*:*:*:*

EPSS

Процентиль: 79%

0.01289

Низкий

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-vw7q-599g-vw99

github

почти 4 года назад