Lucene search

[email protected]CVE-2006-5037

HistorySep 27, 2006 - 11:07 p.m.

CVE-2006-5037

2006-09-2723:07:00

[email protected]

web.nvd.nist.gov

cve-2006-5037

mysource matrix

http proxy server

mime encoded url

cross-site scripting

xss

security vulnerability

nvd

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

6.1 Medium

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

77.1%

JSON

MySource Matrix after 3.8 allows remote attackers to use the application as an HTTP proxy server via a MIME encoded URL in the sq_content_src parameter to access arbitrary sites with the server’s IP address and conduct cross-site scripting (XSS) attacks. NOTE: the researcher reports that "The vendor does not consider this a vulnerability.

Affected configurations

NVD

Node

squizmysource_matrixMatch3.8

squizmysource_matrixMatch3.8.2

squizmysource_matrixMatch3.8.3

squizmysource_matrixMatch3.8.4

squizmysource_matrixMatch3.8.5

squizmysource_matrixMatch3.8.6a

squizmysource_matrixMatch3.10

squizmysource_matrixMatch3.10.1

CPENameOperatorVersion
squiz:mysource_matrixsquiz mysource matrixeq3.8
squiz:mysource_matrixsquiz mysource matrixeq3.8.2
squiz:mysource_matrixsquiz mysource matrixeq3.8.3
squiz:mysource_matrixsquiz mysource matrixeq3.8.4
squiz:mysource_matrixsquiz mysource matrixeq3.8.5
squiz:mysource_matrixsquiz mysource matrixeq3.8.6a
squiz:mysource_matrixsquiz mysource matrixeq3.10
squiz:mysource_matrixsquiz mysource matrixeq3.10.1

CPE	Name	Operator	Version
squiz:mysource_matrix	squiz mysource matrix	eq	3.8
squiz:mysource_matrix	squiz mysource matrix	eq	3.8.2
squiz:mysource_matrix	squiz mysource matrix	eq	3.8.3
squiz:mysource_matrix	squiz mysource matrix	eq	3.8.4
squiz:mysource_matrix	squiz mysource matrix	eq	3.8.5
squiz:mysource_matrix	squiz mysource matrix	eq	3.8.6a
squiz:mysource_matrix	squiz mysource matrix	eq	3.10
squiz:mysource_matrix	squiz mysource matrix	eq	3.10.1

References

secunia.com/advisories/22060

securityreason.com/securityalert/1635

www.aushack.com/advisories/200607-mysourcematrix.txt

www.securityfocus.com/archive/1/446722/100/0/threaded

6.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

6.1 Medium

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

77.1%

JSON

Related for CVE-2006-5037

nvd1 cvelist1