CVE-2010-3931

Cross-site scripting (XSS) vulnerability in multiple Rocomotion products, including P board 1.18 and other versions, P forum 1.30 and earlier, P up board 1.38 and other versions, P diary R 1.13 and earlier, P link 1.11 and earlier, P link compact 1.04 and earlier, pplog 3.31 and earlier, pplog2 3.37 and earlier, PM bbs 1.07 and earlier, PM up bbs 1.08 and earlier, and PM forum 1.18 and earlier, allows remote attackers to inject arbitrary web script or HTML via unknown vectors.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://another.rocomotion.jp/12949466953653.html	Vendor Advisory
http://jvn.jp/en/jp/JVN09115481/index.html	Third Party Advisory
http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-000006.html	Third Party Advisory
http://osvdb.org/70495	Broken Link
http://secunia.com/advisories/42957	Broken Link
http://www.securityfocus.com/bid/45838	Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/64745	Third Party Advisory VDB Entry
http://another.rocomotion.jp/12949466953653.html	Vendor Advisory
http://jvn.jp/en/jp/JVN09115481/index.html	Third Party Advisory
http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-000006.html	Third Party Advisory
http://osvdb.org/70495	Broken Link
http://secunia.com/advisories/42957	Broken Link
http://www.securityfocus.com/bid/45838	Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/64745	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:rocomotion:p_board::::::::
	cpe:2.3:a:rocomotion:p_diary_r::::::::
	cpe:2.3:a:rocomotion:p_forum::::::::
	cpe:2.3:a:rocomotion:p_link::::::::
	cpe:2.3:a:rocomotion:p_link_compact::::::::
	cpe:2.3:a:rocomotion:p_up_board::::::::
	cpe:2.3:a:rocomotion:pm_bbs::::::::
	cpe:2.3:a:rocomotion:pm_forum::::::::
	cpe:2.3:a:rocomotion:pplog::::::::
	cpe:2.3:a:rocomotion:pplog_2::::::::

History

21 Nov 2024, 01:19

Type	Values Removed	Values Added
References	~~() http://another.rocomotion.jp/12949466953653.html - Vendor Advisory~~	() http://another.rocomotion.jp/12949466953653.html - Vendor Advisory
References	~~() http://jvn.jp/en/jp/JVN09115481/index.html - Third Party Advisory~~	() http://jvn.jp/en/jp/JVN09115481/index.html - Third Party Advisory
References	~~() http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-000006.html - Third Party Advisory~~	() http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-000006.html - Third Party Advisory
References	~~() http://osvdb.org/70495 - Broken Link~~	() http://osvdb.org/70495 - Broken Link
References	~~() http://secunia.com/advisories/42957 - Broken Link~~	() http://secunia.com/advisories/42957 - Broken Link
References	~~() http://www.securityfocus.com/bid/45838 - Third Party Advisory, VDB Entry~~	() http://www.securityfocus.com/bid/45838 - Third Party Advisory, VDB Entry
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/64745 - Third Party Advisory, VDB Entry~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/64745 - Third Party Advisory, VDB Entry

Information

Published : 2011-01-20 19:00

Updated : 2025-04-11 00:51

NVD link : CVE-2010-3931

Mitre link : CVE-2010-3931

CVE.ORG link : CVE-2010-3931

JSON object : View

Products Affected

rocomotion

pm_bbs
p_forum
pplog
pplog_2
p_link
pm_forum
p_diary_r
p_link_compact
p_board
p_up_board

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2010-3931", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2011-01-20T19:00:05.193", "references": [{"url": "http://another.rocomotion.jp/12949466953653.html", "tags": ["Vendor Advisory"], "source": "vultures@jpcert.or.jp"}, {"url": "http://jvn.jp/en/jp/JVN09115481/index.html", "tags": ["Third Party Advisory"], "source": "vultures@jpcert.or.jp"}, {"url": "http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-000006.html", "tags": ["Third Party Advisory"], "source": "vultures@jpcert.or.jp"}, {"url": "http://osvdb.org/70495", "tags": ["Broken Link"], "source": "vultures@jpcert.or.jp"}, {"url": "http://secunia.com/advisories/42957", "tags": ["Broken Link"], "source": "vultures@jpcert.or.jp"}, {"url": "http://www.securityfocus.com/bid/45838", "tags": ["Third Party Advisory", "VDB Entry"], "source": "vultures@jpcert.or.jp"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64745", "tags": ["Third Party Advisory", "VDB Entry"], "source": "vultures@jpcert.or.jp"}, {"url": "http://another.rocomotion.jp/12949466953653.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://jvn.jp/en/jp/JVN09115481/index.html", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-000006.html", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://osvdb.org/70495", "tags": ["Broken Link"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://secunia.com/advisories/42957", "tags": ["Broken Link"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/45838", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/64745", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in multiple Rocomotion products, including P board 1.18 and other versions, P forum 1.30 and earlier, P up board 1.38 and other versions, P diary R 1.13 and earlier, P link 1.11 and earlier, P link compact 1.04 and earlier, pplog 3.31 and earlier, pplog2 3.37 and earlier, PM bbs 1.07 and earlier, PM up bbs 1.08 and earlier, and PM forum 1.18 and earlier, allows remote attackers to inject arbitrary web script or HTML via unknown vectors."}, {"lang": "es", "value": "vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en m\u00faltiples productos Rocomotion, incluidos P board v1.18 y otras versiones, P forum v1.30 y anteriores , P up board v1.38 y otras versiones, P diary R v1.13 y anteriores, P link v1.11 y anteriores, P link compact v1.04 y anteriores, pplog v3.31 y anteriores, pplog2 v3.37 y anteriores, PM bbs v1.07 y anteriores, PM up bbs v1.08 y anteriores, y PM forum v1.18 y anteriores, permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s de vectores desconocidos."}], "lastModified": "2025-04-11T00:51:21.963", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:rocomotion:p_board:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ABE2F7F7-76E9-4D08-BE48-AF1A6088B674", "versionEndIncluding": "1.18"}, {"criteria": "cpe:2.3:a:rocomotion:p_diary_r:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "30E67FE9-3D35-4628-B9B1-EB24E3D38EC2", "versionEndIncluding": "1.13"}, {"criteria": "cpe:2.3:a:rocomotion:p_forum:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "21419B2D-347B-4D5F-A9DB-5C1594CBEC76", "versionEndIncluding": "1.30"}, {"criteria": "cpe:2.3:a:rocomotion:p_link:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "442294CF-AA14-44A6-A118-64BC30E60918", "versionEndIncluding": "1.11"}, {"criteria": "cpe:2.3:a:rocomotion:p_link_compact:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6ED4701F-D5BD-44CD-9E41-2E09DCB9D3CA", "versionEndIncluding": "1.04"}, {"criteria": "cpe:2.3:a:rocomotion:p_up_board:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8E2B5EAC-1FAE-49B7-BABA-639F92337BDE", "versionEndIncluding": "1.38"}, {"criteria": "cpe:2.3:a:rocomotion:pm_bbs:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "26026B95-CE50-4C7E-AF28-5D0C8FFBD8E1", "versionEndIncluding": "1.07"}, {"criteria": "cpe:2.3:a:rocomotion:pm_forum:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "48F989A3-5F6B-405E-8565-01D19733FC78", "versionEndIncluding": "1.18"}, {"criteria": "cpe:2.3:a:rocomotion:pplog:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3ECF2833-40BF-4D96-8C39-CAD06B261359", "versionEndIncluding": "3.31"}, {"criteria": "cpe:2.3:a:rocomotion:pplog_2:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A83A5C5A-B35A-4770-B613-A2DCEC380C1F", "versionEndIncluding": "3.37"}], "operator": "OR"}]}], "sourceIdentifier": "vultures@jpcert.or.jp"}

4.3 /10