CVE-2009-1408
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
5.9 Medium
AI Score
Confidence
High
0.004 Low
EPSS
Percentile
74.5%
Cross-site scripting (XSS) vulnerability in webSPELL 4.2.0c allows remote attackers to inject arbitrary web script or HTML allows remote attackers to inject arbitrary web script or HTML via Javascript events such as onmouseover in nested BBcode tags, as demonstrated using (1) email, (2) img, and (3) url tags.
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| webspell:webspell | webspell | eq | 4.2.0c |
References
osvdb.org/53782
secunia.com/advisories/34764
www.securityfocus.com/archive/1/502732/100/0/threaded
www.securityfocus.com/bid/34595
www.webspell.org/index.php?site=files&file=25
www.webspell.org/index.php?site=news_comments&newsID=126&lang=uk
exchange.xforce.ibmcloud.com/vulnerabilities/49937
www.exploit-db.com/exploits/8453
Related
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
5.9 Medium
AI Score
Confidence
High
0.004 Low
EPSS
Percentile
74.5%