Vulnerability CVE-2005-3547
Published: 2005-11-16   Modified: 2012-02-12

Description:
Cross-site scripting (XSS) vulnerability in Invision Power Board 2.1 allows remote attackers to inject arbitrary web script or HTML via the (1) adsess, (2) name, and (3) description parameters in admin.php, and the (4) ACP Notes, (5) Member Name, (6) Password, (7) Email Address, (8) Components, and multiple other input fields.

Type:

CWE-Other

CVSS2 => (AV:N/AC:M/Au:N/C:N/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
4.3/10
2.9/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
None
Partial
None
Affected software
Invision power services -> Invision board 

 References:
http://benji.redkod.org/audits/ipb.2.1.pdf
http://www.securityfocus.com/archive/1/415801/30/0/threaded
http://www.securityfocus.com/bid/15344
http://www.securityfocus.com/bid/15345
https://exchange.xforce.ibmcloud.com/vulnerabilities/22999
Copyright 2024, cxsecurity.com

 

Back to Top