Multiple cross-site scripting (XSS) vulnerabilities in the sample Cache' Server Page (CSP) scripts in InterSystems Cache' allow remote attackers to inject arbitrary web script or HTML via (1) the TO parameter to loop.csp, (2) the VALUE parameter to cookie.csp, and (3) the PAGE parameter to showsource.csp in csp/samples/; and allow remote authenticated users to inject arbitrary web script or HTML via (4) the ERROR parameter to csp/samples/xmlclasseserror.csp, and unspecified vectors in (5) object.csp and (6) lotteryhistory.csp in csp/samples/.
References
Configurations
History
21 Nov 2024, 00:25
Type | Values Removed | Values Added |
---|---|---|
References | () http://www.cpni.gov.uk/Products/alerts/2928.aspx - | |
References | () http://www.mwrinfosecurity.com/advisories/mwri_cache-sample-files-xss-advisory_2007-04-04.pdf - | |
References | () http://www.mwrinfosecurity.com/news/1658.html - |
Information
Published : 2007-08-20 18:17
Updated : 2024-11-21 00:25
NVD link : CVE-2007-0437
Mitre link : CVE-2007-0437
CVE.ORG link : CVE-2007-0437
JSON object : View
Products Affected
intersystems
- cache_database
CWE