CVE-2006-4308

Multiple cross-site scripting (XSS) vulnerabilities in Blackboard Learning System 6, Blackboard Learning and Community Portal Suite 6.2.3.23, and Blackboard Vista 4 allow remote attackers to inject arbitrary Javascript, VBScript, or HTML via (1) data, (2) vbscript, and (3) malformed javascript URIs in various HTML tags when posting to the Discussion Board.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://secunia.com/advisories/21577	Vendor Advisory
http://securitytracker.com/id?1016735
http://www.securityfocus.com/archive/1/444062/100/0/threaded
http://www.securityfocus.com/archive/1/444116/100/0/threaded
http://www.securityfocus.com/archive/1/444885/100/0/threaded
http://www.securityfocus.com/bid/19308
http://www.vupen.com/english/advisories/2006/3366	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/28537

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:blackboard:blackboard:6.0:::::::*
	cpe:2.3:a:blackboard:blackboard_learning_and_community_portal_suite:6.0:::::::*
	cpe:2.3:a:blackboard:blackboard_learning_and_community_portal_suite:6.2.3.23:::::::*
	cpe:2.3:a:blackboard:vista:4:::::::*

History

No history.

Information

Published : 2006-08-23 19:04

Updated : 2018-10-17 21:34

NVD link : CVE-2006-4308

Mitre link : CVE-2006-4308

CVE.ORG link : CVE-2006-4308

JSON object : View

Products Affected

blackboard

blackboard
vista
blackboard_learning_and_community_portal_suite

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2006-4308", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2006-08-23T19:04:00.000", "references": [{"url": "http://secunia.com/advisories/21577", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://securitytracker.com/id?1016735", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/444062/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/444116/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/444885/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/19308", "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2006/3366", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28537", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in Blackboard Learning System 6, Blackboard Learning and Community Portal Suite 6.2.3.23, and Blackboard Vista 4 allow remote attackers to inject arbitrary Javascript, VBScript, or HTML via (1) data, (2) vbscript, and (3) malformed javascript URIs in various HTML tags when posting to the Discussion Board."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en Blackboard Learning System 6 y Blackboard Learning and Community Portal Suite 6.2.3.23, y Blackboard Vista 4 permiten a atacantes remotos inyectar Javascript, VBScript, o HTML de su elecci\u00f3n mediante (1) datos, (2) secuencias de comandos de vb, y (3) URIs javascript mal formados en diversas etiquetas HTML cuando se env\u00eda un mensaje al Foro de Discusi\u00f3n."}], "lastModified": "2018-10-17T21:34:29.397", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:blackboard:blackboard:6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "34DEADE2-62A0-4FDC-8172-7726D8555DC3"}, {"criteria": "cpe:2.3:a:blackboard:blackboard_learning_and_community_portal_suite:6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CAA1C885-E1F2-4AD8-BFC9-4504DA0B9DCF"}, {"criteria": "cpe:2.3:a:blackboard:blackboard_learning_and_community_portal_suite:6.2.3.23:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C08F08EF-A832-4DD3-A6C1-2D38309A0FEF"}, {"criteria": "cpe:2.3:a:blackboard:vista:4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4851F315-7345-4892-B7D9-690D4F11650D"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}