CVE-2004-2509

Cross-site scripting (XSS) vulnerabilities in (1) calendar.php, (2) login.php, and (3) online.php in Infopop UBB.Threads 6.2.3 and 6.5 allow remote attackers to inject arbitrary web script or HTML via the Cat parameter.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://archives.neohapsis.com/archives/fulldisclosure/2004-12/0239.html	Exploit
http://secunia.com/advisories/13452	Vendor Advisory
http://securitytracker.com/id?1012503	Exploit
http://www.osvdb.org/12365	Patch
http://www.osvdb.org/12366	Patch
http://www.osvdb.org/12367	Patch
http://www.securityfocus.com/bid/11900	Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/18432

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ubbcentral:ubb.threads:6.2.3:::::::*
	cpe:2.3:a:ubbcentral:ubb.threads:6.5:::::::*

History

No history.

Information

Published : 2004-12-31 05:00

Updated : 2017-07-11 01:31

NVD link : CVE-2004-2509

Mitre link : CVE-2004-2509

CVE.ORG link : CVE-2004-2509

JSON object : View

Products Affected

ubbcentral

ubb.threads

CWE

NVD-CWE-Other

{"id": "CVE-2004-2509", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2004-12-31T05:00:00.000", "references": [{"url": "http://archives.neohapsis.com/archives/fulldisclosure/2004-12/0239.html", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/13452", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://securitytracker.com/id?1012503", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/12365", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/12366", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/12367", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/11900", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/18432", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerabilities in (1) calendar.php, (2) login.php, and (3) online.php in Infopop UBB.Threads 6.2.3 and 6.5 allow remote attackers to inject arbitrary web script or HTML via the Cat parameter."}], "lastModified": "2017-07-11T01:31:57.810", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ubbcentral:ubb.threads:6.2.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "858FAA03-DD05-472D-9F67-3089262F5E82"}, {"criteria": "cpe:2.3:a:ubbcentral:ubb.threads:6.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "66D3CCE6-909B-46F4-AD8F-603E433C01D2"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}