Lucene search

MitreCVE-2010-0636

HistoryFeb 12, 2010 - 10:30 p.m.

CVE-2010-0636

2010-02-1222:30:00

CWE-79

mitre

web.nvd.nist.gov

cve-2010-0636

cross-site scripting

xss

webcalendar

remote attackers

html

web script

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.8

Confidence

High

EPSS

0.002

Percentile

60.3%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in WebCalendar 1.2.0, and other versions before 1.2.5, allow remote attackers to inject arbitrary web script or HTML via the (1) tab parameter to users.php and the PATH_INFO to (2) day.php, (3) month.php, and (4) week.php. NOTE: some of these details are obtained from third party information.

Affected configurations

Nvd

Node

k5nwebcalendarMatch1.2.0

VendorProductVersionCPE
k5nwebcalendar1.2.0cpe:2.3:a:k5n:webcalendar:1.2.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
k5n	webcalendar	1.2.0	cpe:2.3:a:k5n:webcalendar:1.2.0:::::::*

References

holisticinfosec.org/content/view/133/45/

secunia.com/advisories/38222

webcalendar.cvs.sourceforge.net/viewvc/webcalendar/webcalendar/ChangeLog?pathrev=REL_1_2

www.securityfocus.com/bid/38053

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.8

Confidence

High

EPSS

0.002

Percentile

60.3%

JSON

Related for CVE-2010-0636