CVE-2009-4408

Multiple cross-site scripting (XSS) vulnerabilities in models.parser in PyForum 1.0.3 and possibly earlier versions, and possibly zForum, allow remote attackers to inject arbitrary web script or HTML via crafted BBcode (1) img or (2) url tags, which are not properly handled when a post is viewed.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://secunia.com/advisories/37764	Vendor Advisory
http://www.osvdb.org/61051
http://www.securityfocus.com/archive/1/508478/100/0/threaded
https://exchange.xforce.ibmcloud.com/vulnerabilities/54855
http://secunia.com/advisories/37764	Vendor Advisory
http://www.osvdb.org/61051
http://www.securityfocus.com/archive/1/508478/100/0/threaded
https://exchange.xforce.ibmcloud.com/vulnerabilities/54855

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:pyforum:pyforum::::::::
	cpe:2.3:a:pyforum:pyforum:1.0.0:::::::*
	cpe:2.3:a:pyforum:pyforum:1.0.1:::::::*
	cpe:2.3:a:pyforum:pyforum:1.0.2:::::::*

History

21 Nov 2024, 01:09

Type	Values Removed	Values Added
References	~~() http://secunia.com/advisories/37764 - Vendor Advisory~~	() http://secunia.com/advisories/37764 - Vendor Advisory
References	~~() http://www.osvdb.org/61051 -~~	() http://www.osvdb.org/61051 -
References	~~() http://www.securityfocus.com/archive/1/508478/100/0/threaded -~~	() http://www.securityfocus.com/archive/1/508478/100/0/threaded -
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/54855 -~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/54855 -

Information

Published : 2009-12-23 21:30

Updated : 2024-11-21 01:09

NVD link : CVE-2009-4408

Mitre link : CVE-2009-4408

CVE.ORG link : CVE-2009-4408

JSON object : View

Products Affected

pyforum

pyforum

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2009-4408", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2009-12-23T21:30:00.280", "references": [{"url": "http://secunia.com/advisories/37764", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/61051", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/508478/100/0/threaded", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/54855", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/37764", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.osvdb.org/61051", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/archive/1/508478/100/0/threaded", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/54855", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in models.parser in PyForum 1.0.3 and possibly earlier versions, and possibly zForum, allow remote attackers to inject arbitrary web script or HTML via crafted BBcode (1) img or (2) url tags, which are not properly handled when a post is viewed."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en models.parser en PyForum v1.0.3 y probablemente versiones anteriores, y probablemente zForum, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n mediante las etiquetas modificadas BBcode (1) img o (2) url, no siendo adecuadamente gestionadas cuando se visualiza una entrada del foro."}], "lastModified": "2024-11-21T01:09:34.433", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pyforum:pyforum:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4A142286-A943-4E58-8B80-C6FF73CEE821", "versionEndIncluding": "1.0.3"}, {"criteria": "cpe:2.3:a:pyforum:pyforum:1.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8D91E4F4-5D7B-4B60-B1C5-255D3FEA8AD2"}, {"criteria": "cpe:2.3:a:pyforum:pyforum:1.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "380801DB-032F-4A0C-98F0-766F4B2540D2"}, {"criteria": "cpe:2.3:a:pyforum:pyforum:1.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DAD9136D-39B6-4A68-9C63-160808688C84"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}