| Vulnerability Name: | CCN-10696 | ||||||
| Published: | 2002-11-25 | ||||||
| Updated: | 2002-11-25 | ||||||
| Summary: | phpBB is vulnerable to cross-site scripting, caused by improper filtering of HTML tags. A remote attacker could embed malicious script within HTML tags in a forum message, which would be executed in the victim's Web browser within the security context of the hosting site, once the message is viewed. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. | ||||||
| CVSS v3 Severity: | 3.7 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
| ||||||
| CVSS v2 Severity: | 2.6 Low (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N) 2.4 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N/E:H/RL:U/RC:UR)
| ||||||
| Vulnerability Consequences: | Gain Access | ||||||
| References: | Source: CCN Type: BugTraq Mailing List, Mon Aug 18 2003 - 14:56:59 CDT XSS vulnerability in phpBB Source: CCN Type: BugTraq Mailing List, 2002-11-25 8:51:57 [Sec-Tec Advisory] Local scripting vulnerability in phpBB Source: CCN Type: phpBB Web site phpBB:: Creating Communities Source: CCN Type: BID-6248 phpBB Script Injection Vulnerability Source: XF Type: UNKNOWN phpbb-forum-msg-xss(10696) | ||||||
| Vulnerable Configuration: | Configuration CCN 1: Denotes that component is vulnerable | ||||||
| BACK | |||||||