CVE-2007-2847 - Multiple cross-site scripting (XSS) vulnerabilities in hlstats.php in HLstats 1.35, and possibly ear

CVE-2007-2847

Summary

Multiple cross-site scripting (XSS) vulnerabilities in hlstats.php in HLstats 1.35, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) authusername or (2) authpassword parameter, different vectors than CVE-2007-0840 and CVE-2007-2812.

References

http://osvdb.org/36215
http://www.securityfocus.com/archive/1/469291/100/0/threaded
http://www.securityfocus.com/bid/24102
https://exchange.xforce.ibmcloud.com/vulnerabilities/34450

Vulnerable Configurations

cpe:2.3:a:hlstats:hlstats:*:*:*:*:*:*:*:*
cpe:2.3:a:hlstats:hlstats:*:*:*:*:*:*:*:*

CVSS

Base:	9.3 (as of 16-10-2018 - 16:45)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
COMPLETE	COMPLETE	COMPLETE

cvss-vector via4

AV:N/AC:M/Au:N/C:C/I:C/A:C

refmap via4

bid	24102
bugtraq	20070521 RedLevel Advisory #020 - HLstats v1.35 Cross-Site Scripting Vulnerability #3
osvdb	36215
xf	hlstats-authusername-authpassword-xss(34450)

Last major update

16-10-2018 - 16:45

Published

24-05-2007 - 18:30

Last modified

16-10-2018 - 16:45