CVE-2007-6700

Cross-site scripting (XSS) vulnerability in cgi-bin/bgplg in the web interface for the BGPD daemon in OpenBSD 4.1 allows remote attackers to inject arbitrary web script or HTML via the cmd parameter.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://secunia.com/advisories/28726	Patch
http://www.mail-archive.com/misc%40openbsd.org/msg49057.html
http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/bgplg/bgplg.c	Patch
http://www.securityfocus.com/archive/1/487350/100/0/threaded
http://www.securityfocus.com/archive/1/487369/100/0/threaded	Exploit
http://www.securityfocus.com/bid/27535	Patch
http://www.securitytracker.com/id?1019288

Configurations

Configuration 1 (hide)

cpe:2.3:o:openbsd:openbsd:4.1:*:*:*:*:*:*:*

History

No history.

Information

Published : 2008-02-05 02:00

Updated : 2024-02-04 17:13

NVD link : CVE-2007-6700

Mitre link : CVE-2007-6700

CVE.ORG link : CVE-2007-6700

JSON object : View

Products Affected

openbsd

openbsd

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2007-6700", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2008-02-05T02:00:00.000", "references": [{"url": "http://secunia.com/advisories/28726", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://www.mail-archive.com/misc%40openbsd.org/msg49057.html", "source": "cve@mitre.org"}, {"url": "http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/bgplg/bgplg.c", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/487350/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/487369/100/0/threaded", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/27535", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://www.securitytracker.com/id?1019288", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in cgi-bin/bgplg in the web interface for the BGPD daemon in OpenBSD 4.1 allows remote attackers to inject arbitrary web script or HTML via the cmd parameter."}, {"lang": "es", "value": "Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en cgi-bin/bgplg en la interfaz web para el demonio BGPD de OpernBSD 4.1 permite a atacantes remotos inyectar web script o HTML de su elecci\u00f3n a trav\u00e9s del par\u00e1metro cmd."}], "lastModified": "2023-11-07T02:01:36.530", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:openbsd:openbsd:4.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "16C117F3-3684-4683-9F9E-CEDD5B88F9CA"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}