CVE-2005-2649 - Cross-site scripting (XSS) vulnerability in ATutor 1.5.1 allows remote attackers to inject arbitrary

CVE-2005-2649

Summary

Cross-site scripting (XSS) vulnerability in ATutor 1.5.1 allows remote attackers to inject arbitrary web script or HTML via (1) course parameter in login.php or (2) words parameter in search.php.

References

http://secunia.com/advisories/16496
http://www.securityfocus.com/archive/1/408521
http://www.securityfocus.com/bid/14598
https://exchange.xforce.ibmcloud.com/vulnerabilities/21910

Vulnerable Configurations

cpe:2.3:a:adaptive_technology_resource_centre:atutor:1.5.1:*:*:*:*:*:*:*
cpe:2.3:a:adaptive_technology_resource_centre:atutor:1.5.1:*:*:*:*:*:*:*

CVSS

Base:	4.3 (as of 11-07-2017 - 01:32)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
NONE	PARTIAL	NONE

cvss-vector via4

AV:N/AC:M/Au:N/C:N/I:P/A:N

refmap via4

bid	14598
bugtraq	20050818 ATutor 1.5.1 and prior multiple XSS Vulnerabilities
secunia	16496
xf	atutor-login-search-xss(21910)

Last major update

11-07-2017 - 01:32

Published

23-08-2005 - 04:00

Last modified

11-07-2017 - 01:32