Lucene search

[email protected]CVE-2008-6946

HistoryAug 12, 2009 - 10:30 a.m.

CVE-2008-6946

2009-08-1210:30:00

CWE-79

[email protected]

web.nvd.nist.gov

cross-site scripting

xss

collabtive

0.4.8

vulnerability

web script

html

remote attackers

admin.php

manageproject.php

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.8 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

60.3%

JSON

Cross-site scripting (XSS) vulnerability in manageproject.php in Collabtive 0.4.8 allows user-assisted remote attackers to inject arbitrary web script or HTML via the project Name, which is not properly handled when the administrator performs an editform action, related to admin.php.

Affected configurations

NVD

Node

collabtivecollabtiveMatch0.4.8

CPENameOperatorVersion
collabtive:collabtivecollabtiveeq0.4.8

CPE	Name	Operator	Version
collabtive:collabtive	collabtive	eq	0.4.8

References

www.securityfocus.com/archive/1/498186/100/0/threaded

www.securityfocus.com/bid/32229

exchange.xforce.ibmcloud.com/vulnerabilities/46496

www.exploit-db.com/exploits/7076

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.8 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

60.3%

JSON

Related for CVE-2008-6946

nvd1 cvelist1 prion1