CVE-2004-1809

Cross-site scripting (XSS) vulnerability in phpBB 2.0.6d and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) postdays parameter to viewtopic.php or (2) topicdays parameter to viewforum.php.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://marc.info/?l=bugtraq&m=107920498205324&w=2
http://secunia.com/advisories/11121	Patch
http://www.osvdb.org/4257
http://www.osvdb.org/4259
http://www.phpbb.com/support/documents.php?mode=changelog#206
http://www.securityfocus.com/bid/9865	Patch
http://www.securityfocus.com/bid/9866	Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/15464

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:phpbb_group:phpbb:2.0.0:::::::*
	cpe:2.3:a:phpbb_group:phpbb:2.0.1:::::::*
	cpe:2.3:a:phpbb_group:phpbb:2.0.2:::::::*
	cpe:2.3:a:phpbb_group:phpbb:2.0.3:::::::*
	cpe:2.3:a:phpbb_group:phpbb:2.0.4:::::::*
	cpe:2.3:a:phpbb_group:phpbb:2.0.5:::::::*
	cpe:2.3:a:phpbb_group:phpbb:2.0.6:::::::*
	cpe:2.3:a:phpbb_group:phpbb:2.0.6c:::::::*
	cpe:2.3:a:phpbb_group:phpbb:2.0.6d:::::::*
	cpe:2.3:a:phpbb_group:phpbb:2.0_rc1:::::::*
	cpe:2.3:a:phpbb_group:phpbb:2.0_rc2:::::::*
	cpe:2.3:a:phpbb_group:phpbb:2.0_rc3:::::::*
	cpe:2.3:a:phpbb_group:phpbb:2.0_rc4:::::::*

History

No history.

Information

Published : 2004-12-31 05:00

Updated : 2017-07-11 01:31

NVD link : CVE-2004-1809

Mitre link : CVE-2004-1809

CVE.ORG link : CVE-2004-1809

JSON object : View

Products Affected

phpbb_group

phpbb

CWE

NVD-CWE-Other

{"id": "CVE-2004-1809", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2004-12-31T05:00:00.000", "references": [{"url": "http://marc.info/?l=bugtraq&m=107920498205324&w=2", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/11121", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/4257", "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/4259", "source": "cve@mitre.org"}, {"url": "http://www.phpbb.com/support/documents.php?mode=changelog#206", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/9865", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/9866", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15464", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in phpBB 2.0.6d and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) postdays parameter to viewtopic.php or (2) topicdays parameter to viewforum.php."}], "lastModified": "2017-07-11T01:31:21.983", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:phpbb_group:phpbb:2.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E3B77B44-C3C9-4BC8-8D39-2200F1BACC07"}, {"criteria": "cpe:2.3:a:phpbb_group:phpbb:2.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7C74C78D-EEE0-48DF-9721-2A43B996EBD5"}, {"criteria": "cpe:2.3:a:phpbb_group:phpbb:2.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "054EFBD3-2252-4173-B37A-B8CA0218CE0C"}, {"criteria": "cpe:2.3:a:phpbb_group:phpbb:2.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "00EB368F-5471-42E3-BBBE-EF9E623A7259"}, {"criteria": "cpe:2.3:a:phpbb_group:phpbb:2.0.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F65406CF-59F1-48DC-8ABC-501F210A8B73"}, {"criteria": "cpe:2.3:a:phpbb_group:phpbb:2.0.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "03AC5144-140D-48E9-87FD-96F2E248D4E4"}, {"criteria": "cpe:2.3:a:phpbb_group:phpbb:2.0.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A8F12660-10A7-4B66-94B0-954C9CD7D36C"}, {"criteria": "cpe:2.3:a:phpbb_group:phpbb:2.0.6c:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D9D9A19A-7A43-4E67-A5A7-7DF60926EB95"}, {"criteria": "cpe:2.3:a:phpbb_group:phpbb:2.0.6d:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1DFBF5F9-AA51-45A7-BE6E-0A06778773B3"}, {"criteria": "cpe:2.3:a:phpbb_group:phpbb:2.0_rc1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "639E102D-2BD2-42FF-999A-02135A3E5647"}, {"criteria": "cpe:2.3:a:phpbb_group:phpbb:2.0_rc2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AA7F5CF1-4610-47D0-A6DD-DCB55645245D"}, {"criteria": "cpe:2.3:a:phpbb_group:phpbb:2.0_rc3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FB898F63-F327-44B1-B6A2-889E490E583F"}, {"criteria": "cpe:2.3:a:phpbb_group:phpbb:2.0_rc4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "894A26BD-2D8B-4DE7-BEE3-940A0498DB74"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}