CVE-2006-3212

Cross-site scripting (XSS) vulnerability in sign.php in cjGuestbook 1.3 and earlier allows remote attackers to inject web script or HTML via the (1) name, (2) email, (3) add, and (4) wName parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://secunia.com/advisories/20751
http://www.securityfocus.com/bid/18591
http://www.vupen.com/english/advisories/2006/2488
https://exchange.xforce.ibmcloud.com/vulnerabilities/27326

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:cjguestbook:cjguestbook::::::::
	cpe:2.3:a:cjguestbook:cjguestbook:1.2:::::::*

History

No history.

Information

Published : 2006-06-24 01:06

Updated : 2017-07-20 01:32

NVD link : CVE-2006-3212

Mitre link : CVE-2006-3212

CVE.ORG link : CVE-2006-3212

JSON object : View

Products Affected

cjguestbook

cjguestbook

CWE

NVD-CWE-Other

{"id": "CVE-2006-3212", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2006-06-24T01:06:00.000", "references": [{"url": "http://secunia.com/advisories/20751", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/18591", "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2006/2488", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27326", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in sign.php in cjGuestbook 1.3 and earlier allows remote attackers to inject web script or HTML via the (1) name, (2) email, (3) add, and (4) wName parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en sign.php en cjGuestbook v1.3, permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s del par\u00e1metro (1) name, (2) email, (3) add y (4) WName. NOTA: la procedencia de esta informaci\u00f3n es desconocida, los detalles se han obtenido \u00fanicamente de informaci\u00f3n de terceros."}], "lastModified": "2017-07-20T01:32:08.210", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cjguestbook:cjguestbook:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C711815A-A4DD-4E5D-A3DB-FC7DB1F7A3F9", "versionEndIncluding": "1.3"}, {"criteria": "cpe:2.3:a:cjguestbook:cjguestbook:1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7B40858C-7B2D-4853-9919-C02B9FD39E57"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}