CVE-2004-1862 - Multiple cross-site scripting (XSS) vulnerabilities in Extreme Messageboard (XMB) 1.8 SP3 and 1.9 be

CVE-2004-1862

Summary

Multiple cross-site scripting (XSS) vulnerabilities in Extreme Messageboard (XMB) 1.8 SP3 and 1.9 beta allow remote attackers to inject arbitrary web script or HTML via the (1) xmbuser parameter to xmb.php, (2) folder parameter to u2u.php, (3) viewmost, replymost, or latest parameter to stats.php, (4) message or icons parameter to post.php, (5) threadlist, pagelinks, forumlist, navigation, or (6) forumdisplay parameter to forumdisplay.php.

References

Vulnerable Configurations

cpe:2.3:a:xmb_forum:xmb:1.8_sp3:*:*:*:*:*:*:*
cpe:2.3:a:xmb_forum:xmb:1.8_sp3:*:*:*:*:*:*:*
cpe:2.3:a:xmb_forum:xmb:1.9_beta:*:*:*:*:*:*:*
cpe:2.3:a:xmb_forum:xmb:1.9_beta:*:*:*:*:*:*:*

CVSS

Base:	4.3 (as of 29-04-2021 - 15:15)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
NONE	PARTIAL	NONE

cvss-vector via4

AV:N/AC:M/Au:N/C:N/I:P/A:N

refmap via4

bid	9983
bugtraq	20040326 [waraxe-2004-SA#012 - Multiple vulnerabilities in XMB Forum 1.8 Partagium SP3 and 1.9 Nexus Beta]
osvdb	14983 14985 14986 14987 14988
secunia	11230
xf	xmb-forum-multiple-xss(15654)

statements via4

contributor	Robert Chapin
lastmodified	2020-09-09
organization	XMB
statement	As noted in https://docs.xmbforum2.com/index.php?title=Security_Issue_History XMB version 1.9.10 or later must be installed to prevent attacks described by this CVE. All earlier versions of XMB are vulnerable until upgraded. Upgrades are available at https://www.xmbforum2.com/

Last major update

29-04-2021 - 15:15

Published

26-03-2004 - 05:00

Last modified

29-04-2021 - 15:15