CVE-2007-3653

Multiple cross-site scripting (XSS) vulnerabilities in Farsi Script (aka FaScript) FaName 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) key or (2) desc parameter to index.php, or (3) the name parameter to page.php.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://descriptions.securescout.com/tc/17973
http://www.netvigilance.com/advisory0043
https://exchange.xforce.ibmcloud.com/vulnerabilities/43502
http://descriptions.securescout.com/tc/17973
http://www.netvigilance.com/advisory0043
https://exchange.xforce.ibmcloud.com/vulnerabilities/43502

Configurations

Configuration 1 (hide)

cpe:2.3:a:fascript:faname:1.0:*:*:*:*:*:*:*

History

21 Nov 2024, 00:33

Type	Values Removed	Values Added
References	~~() http://descriptions.securescout.com/tc/17973 -~~	() http://descriptions.securescout.com/tc/17973 -
References	~~() http://www.netvigilance.com/advisory0043 -~~	() http://www.netvigilance.com/advisory0043 -
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/43502 -~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/43502 -

Information

Published : 2008-07-09 00:41

Updated : 2024-11-21 00:33

NVD link : CVE-2007-3653

Mitre link : CVE-2007-3653

CVE.ORG link : CVE-2007-3653

JSON object : View

Products Affected

fascript

faname

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2007-3653", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2008-07-09T00:41:00.000", "references": [{"url": "http://descriptions.securescout.com/tc/17973", "source": "cve@mitre.org"}, {"url": "http://www.netvigilance.com/advisory0043", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43502", "source": "cve@mitre.org"}, {"url": "http://descriptions.securescout.com/tc/17973", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.netvigilance.com/advisory0043", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43502", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in Farsi Script (aka FaScript) FaName 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) key or (2) desc parameter to index.php, or (3) the name parameter to page.php."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de Secuencias de Comandos en Sitios Cruzados (XSS) en Farsi Script (tambi\u00e9n conocido como FaScript) FaName 1.0, permite a atacantes remotos inyectar secuencias de comandos Web o HTML mediante un par\u00e1metro (1) key o (2) desc en index.php, o (3) el par\u00e1metro name en page.php."}], "lastModified": "2024-11-21T00:33:45.190", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fascript:faname:1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CFFF8451-6F54-4A58-A981-1A1EF4971D6E"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}