CVE-2010-3457

2010-09-1720:00:02

CWE-79

mitre

web.nvd.nist.gov

symphony cms

cross-site scripting

xss

vulnerabilities

remote attackers

web script

html

cve-2010-3457

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

5.9

Confidence

High

EPSS

0.004

Percentile

74.1%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in Symphony CMS 2.0.7 and 2.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) fields[website] parameter in the post comments feature in articles/a-primer-to-symphony-2s-default-theme/ or (2) send-email[recipient] parameter to about/. NOTE: some of these details are obtained from third party information.

Affected configurations

Nvd

Node

getsymphonysymphonyMatch2.0.7

getsymphonysymphonyMatch2.1.1

VendorProductVersionCPE
getsymphonysymphony2.0.7cpe:2.3:a:getsymphony:symphony:2.0.7:*:*:*:*:*:*:*
getsymphonysymphony2.1.1cpe:2.3:a:getsymphony:symphony:2.1.1:*:*:*:*:*:*:*