Lucene search

[email protected]CVE-2011-4572

HistoryNov 29, 2011 - 11:55 a.m.

CVE-2011-4572

2011-11-2911:55:09

CWE-79

[email protected]

web.nvd.nist.gov

cve-2011-4572

xss vulnerability

cf image hosting script

web security

nvd

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.9 Medium

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

74.2%

JSON

Cross-site scripting (XSS) vulnerability in inc/tesmodrewite.php in CF Image Hosting Script 1.3.82, 1.4.1, and probably other versions before 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the q parameter. NOTE: this was originally reported as a file disclosure vulnerability, but this is likely inaccurate.

Affected configurations

NVD

Node

codefuturecf_image_hosting_scriptMatch1.3.82

codefuturecf_image_hosting_scriptMatch1.4.1

CPENameOperatorVersion
codefuture:cf_image_hosting_scriptcodefuture cf image hosting scripteq1.3.82
codefuture:cf_image_hosting_scriptcodefuture cf image hosting scripteq1.4.1

CPE	Name	Operator	Version
codefuture:cf_image_hosting_script	codefuture cf image hosting script	eq	1.3.82
codefuture:cf_image_hosting_script	codefuture cf image hosting script	eq	1.4.1

References

osvdb.org/76059

packetstormsecurity.org/files/view/105524/cfimagehosting1382-disclose.txt

secunia.com/advisories/46290

www.exploit-db.com/exploits/17927

exchange.xforce.ibmcloud.com/vulnerabilities/70347

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.9 Medium

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

74.2%

JSON

Related for CVE-2011-4572

nvd1 cvelist1 prion1