CVE-2005-1231 - Cross-site scripting (XSS) vulnerability in the NewTerm function in GlossaryModel.php in JAWS 0.4 al

CVE-2005-1231

Summary

Cross-site scripting (XSS) vulnerability in the NewTerm function in GlossaryModel.php in JAWS 0.4 allows remote attackers to inject arbitrary web script or HTML via the (1) term or (2) description.

References

http://seclists.org/lists/fulldisclosure/2005/Apr/0416.html
http://www.securiteam.com/unixfocus/5RP0M0AFFS.html
http://www.securityfocus.com/bid/13254

Vulnerable Configurations

cpe:2.3:a:jaws:jaws:0.3:*:*:*:*:*:*:*
cpe:2.3:a:jaws:jaws:0.3:*:*:*:*:*:*:*
cpe:2.3:a:jaws:jaws:0.4:*:*:*:*:*:*:*
cpe:2.3:a:jaws:jaws:0.4:*:*:*:*:*:*:*
cpe:2.3:a:jaws:jaws:0.5_beta2:*:*:*:*:*:*:*
cpe:2.3:a:jaws:jaws:0.5_beta2:*:*:*:*:*:*:*

CVSS

Base:	4.3 (as of 05-09-2008 - 20:48)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
NONE	PARTIAL	NONE

cvss-vector via4

AV:N/AC:M/Au:N/C:N/I:P/A:N

refmap via4

bid	13254
fulldisc	20050418 XSS bug in JAWS gadget Glossary (0.4-latestbeta (beta 2))
misc	http://www.securiteam.com/unixfocus/5RP0M0AFFS.html

Last major update

05-09-2008 - 20:48

Published

02-05-2005 - 04:00

Last modified

05-09-2008 - 20:48