CVE-2012-1935

2012-08-2721:55:01

CWE-79

[email protected]

web.nvd.nist.gov

cve-2012-1935

newscoop

xss

vulnerability

web script

html

nvd

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.7 Medium

AI Score

Confidence

High

0.006 Low

EPSS

Percentile

78.6%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in Newscoop 3.5.x before 3.5.5 and 4.x before 4 RC4 allow remote attackers to inject arbitrary web script or HTML via the (1) Back parameter to admin/ad.php, or the (2) token or (3) f_email parameter to admin/password_check_token.php.

Affected configurations

NVD

Node

sourcefabricnewscoopMatch3.5.0

sourcefabricnewscoopMatch3.5.1

sourcefabricnewscoopMatch3.5.2

sourcefabricnewscoopMatch3.5.3

sourcefabricnewscoopMatch3.5.4

sourcefabricnewscoopMatch4rc3

CPENameOperatorVersion
sourcefabric:newscoopsourcefabric newscoopeq3.5.0
sourcefabric:newscoopsourcefabric newscoopeq3.5.1
sourcefabric:newscoopsourcefabric newscoopeq3.5.2
sourcefabric:newscoopsourcefabric newscoopeq3.5.3
sourcefabric:newscoopsourcefabric newscoopeq3.5.4
sourcefabric:newscoopsourcefabric newscoopeq4

CPE	Name	Operator	Version
sourcefabric:newscoop	sourcefabric newscoop	eq	3.5.0
sourcefabric:newscoop	sourcefabric newscoop	eq	3.5.1
sourcefabric:newscoop	sourcefabric newscoop	eq	3.5.2
sourcefabric:newscoop	sourcefabric newscoop	eq	3.5.3
sourcefabric:newscoop	sourcefabric newscoop	eq	3.5.4
sourcefabric:newscoop	sourcefabric newscoop	eq	4