CVE-2012-1979

2012-04-1718:55:01

CWE-79

[email protected]

web.nvd.nist.gov

cve-2012-1979

xss vulnerability

syndeocms 3.0.01

security vulnerability

nvd

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

5.3 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

66.4%

JSON

Cross-site scripting (XSS) vulnerability in starnet/index.php in SyndeoCMS 3.0.01 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the email parameter (aka Email address field) in an edit_user configuration action.

Affected configurations

NVD

Node

syndeocmssyndeocmsRange≤3.0.01

syndeocmssyndeocmsMatch2.4

syndeocmssyndeocmsMatch2.4.10

syndeocmssyndeocmsMatch2.5.00

syndeocmssyndeocmsMatch2.5.01

syndeocmssyndeocmsMatch2.6.00

syndeocmssyndeocmsMatch2.7.00

syndeocmssyndeocmsMatch2.8.00

syndeocmssyndeocmsMatch2.8.1

syndeocmssyndeocmsMatch2.8.02

syndeocmssyndeocmsMatch2.9.00

syndeocmssyndeocmsMatch3.0.00

CPENameOperatorVersion
syndeocms:syndeocmssyndeocmsle3.0.01
syndeocms:syndeocmssyndeocmseq2.4
syndeocms:syndeocmssyndeocmseq2.4.10
syndeocms:syndeocmssyndeocmseq2.5.00
syndeocms:syndeocmssyndeocmseq2.5.01
syndeocms:syndeocmssyndeocmseq2.6.00
syndeocms:syndeocmssyndeocmseq2.7.00
syndeocms:syndeocmssyndeocmseq2.8.00
syndeocms:syndeocmssyndeocmseq2.8.1
syndeocms:syndeocmssyndeocmseq2.8.02

CPE	Name	Operator	Version
syndeocms:syndeocms	syndeocms	le	3.0.01
syndeocms:syndeocms	syndeocms	eq	2.4
syndeocms:syndeocms	syndeocms	eq	2.4.10
syndeocms:syndeocms	syndeocms	eq	2.5.00
syndeocms:syndeocms	syndeocms	eq	2.5.01
syndeocms:syndeocms	syndeocms	eq	2.6.00
syndeocms:syndeocms	syndeocms	eq	2.7.00
syndeocms:syndeocms	syndeocms	eq	2.8.00
syndeocms:syndeocms	syndeocms	eq	2.8.1
syndeocms:syndeocms	syndeocms	eq	2.8.02