CVE-2010-4734

Multiple cross-site scripting (XSS) vulnerabilities in the comment feature in Skeletonz CMS 1.0, when the Blog plugin is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) Name, (2) Website, and (3) Email parameters. NOTE: some of these details are obtained from third party information.

CVSS v2.0 2.6 LOW

2.6^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:H/Au:N/C:N/I:P/A:N

Exploitability : 4.9 / Impact : 2.9

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://packetstormsecurity.org/files/view/96151/skeletonzcms-xss.txt	Exploit
http://secunia.com/advisories/42385	Vendor Advisory
http://securityreason.com/securityalert/8081
http://www.exploit-db.com/exploits/15625	Exploit
http://www.osvdb.org/69514
http://www.securityfocus.com/bid/45081	Exploit

Configurations

Configuration 1 (hide)

cpe:2.3:a:amix:skeletonz_cms_1.0:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2011-02-16 03:00

Updated : 2024-02-04 17:54

NVD link : CVE-2010-4734

Mitre link : CVE-2010-4734

CVE.ORG link : CVE-2010-4734

JSON object : View

Products Affected

amix

skeletonz_cms_1.0

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2010-4734", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.6, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "HIGH", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2011-02-16T03:00:01.523", "references": [{"url": "http://packetstormsecurity.org/files/view/96151/skeletonzcms-xss.txt", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/42385", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://securityreason.com/securityalert/8081", "source": "cve@mitre.org"}, {"url": "http://www.exploit-db.com/exploits/15625", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/69514", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/45081", "tags": ["Exploit"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in the comment feature in Skeletonz CMS 1.0, when the Blog plugin is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) Name, (2) Website, and (3) Email parameters. NOTE: some of these details are obtained from third party information."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en la caracter\u00edstica de comentarios en Skeletonz CMS v1.0, cuando el componente Blog est\u00e1 habilitado, permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s de los par\u00e1metros (1) Nombre, (2) Sitio Web, y (3) Correo electr\u00f3nico. NOTA: algunos de estos detalles han sido obtenidos de informaci\u00f3n de terceros."}], "lastModified": "2011-09-22T03:27:12.710", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:amix:skeletonz_cms_1.0:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "81F9CDBA-F26F-47A0-9903-0ABD309B661A"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}