Assetman <= 2.4a XSS

2006-05-30 / 2006-05-31

Credit: zerogue gmail com

Risk: Low

Local: No

Remote: Yes

CVE: CVE-2006-2641

CWE: CWE-79

CVSS Base Score: 5.8/10

Impact Subscore: 4.9/10

Exploitability Subscore: 8.6/10

Exploit range: Remote

Attack complexity: Medium

Authentication: No required

Confidentiality impact: Partial

Integrity impact: Partial

Availability impact: None

Assetman <= 2.4a XSS

Discovered by: Nomenumbra

Date: 23/5/2006

impact:moderate (privilege escalation,possible defacement)

Assetman doesn't filter any of it's input, allowing users

to inject arbitrary HTML or javascript code.

Nomenumbra

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Assetman <= 2.4a XSS

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.