CVE-2006-5958

Multiple cross-site scripting (XSS) vulnerabilities in INFINICART allow remote attackers to inject arbitrary web script or HTML via the (1) username and (2) password fields in (a) login.asp, (3) search field in (b) search.asp, and (4) email field in (c) sendpassword.asp.

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://secunia.com/advisories/22865	Vendor Advisory
http://securityreason.com/securityalert/1881
http://www.securityfocus.com/archive/1/451322/100/0/threaded
http://www.securityfocus.com/bid/21043	Exploit
http://www.vupen.com/english/advisories/2006/4501
https://exchange.xforce.ibmcloud.com/vulnerabilities/30233

Configurations

Configuration 1 (hide)

cpe:2.3:a:infinicart:infinicart:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2006-11-17 01:07

Updated : 2018-10-17 21:46

NVD link : CVE-2006-5958

Mitre link : CVE-2006-5958

CVE.ORG link : CVE-2006-5958

JSON object : View

Products Affected

infinicart

infinicart

CWE

NVD-CWE-Other

{"id": "CVE-2006-5958", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2006-11-17T01:07:00.000", "references": [{"url": "http://secunia.com/advisories/22865", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://securityreason.com/securityalert/1881", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/archive/1/451322/100/0/threaded", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/21043", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2006/4501", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30233", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in INFINICART allow remote attackers to inject arbitrary web script or HTML via the (1) username and (2) password fields in (a) login.asp, (3) search field in (b) search.asp, and (4) email field in (c) sendpassword.asp."}, {"lang": "es", "value": "M\u00faltiples vulnerabildiades de secuencias de comandos en sitios cruzados (XSS) en INFINICART permite a un atacante remoto inyectar secuencias de comandos web o HTML a trav\u00e9s de los campos (1) username y (2) password en (a) login.asp, (3) search field in (b) search.asp, y (4) el campo field en (c) sendpassword.asp."}], "lastModified": "2018-10-17T21:46:06.950", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:infinicart:infinicart:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "054DDD74-BD07-4E44-B6C7-01F0707EDFE4"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}