CVE-2006-5652 - Cross-site scripting (XSS) vulnerability in Sun iPlanet Messaging Server Messenger Express allows re

CVE-2006-5652

Summary

Cross-site scripting (XSS) vulnerability in Sun iPlanet Messaging Server Messenger Express allows remote attackers to inject arbitrary web script via the expression Cascading Style Sheets (CSS) function, as demonstrated by setting the width style for an IMG element. NOTE: this issue might be related to CVE-2006-5486, however due to the vagueness of the initial advisory and different researchers, it has been assigned a new CVE.

References

Vulnerable Configurations

cpe:2.3:a:sun:iplanet_messaging_server_messenger_express:*:*:*:*:*:*:*:*
cpe:2.3:a:sun:iplanet_messaging_server_messenger_express:*:*:*:*:*:*:*:*

CVSS

Base:	4.3 (as of 17-10-2018 - 21:44)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
NONE	PARTIAL	NONE

cvss-vector via4

AV:N/AC:M/Au:N/C:N/I:P/A:N

refmap via4

bid	20838
bugtraq	20061031 Cross Site Scripting (XSS) Vulnerability in iPlanet Messaging Server Messenger Express by "Sun"
fulldisc	20061031 Cross Site Scripting (XSS) Vulnerability in iPlanet Messaging Server Messenger Express by "Sun"
sreason	1806
xf	sun-messaging-expression-xss(29929)

Last major update

17-10-2018 - 21:44

Published

03-11-2006 - 00:07

Last modified

17-10-2018 - 21:44