Vulnerability CVE-2006-0165 - CERT Civis.Net

Vulnerability Name:

CVE-2006-0165 (CCN-24053)

Assigned:

2006-01-10

Published:

2006-01-10

Updated:

2017-07-20

Summary:

Cross-site scripting (XSS) vulnerability in the DataForm Entries functionality in Plain Black WebGUI before 6.8.4 (gamma) allows remote attackers to inject arbitrary Javascript via the (1) url and (2) name field of the default email form.

CVSS v3 Severity:

3.7 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): High Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): None Availibility (A): None

CVSS v2 Severity:

4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

2.6 Low (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N)
2.2 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N/E:H/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): High Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2006-0165

Source: CCN
Type: SA18372
WebGUI Form Module Script Insertion Vulnerability

Source: SECUNIA
Type: Patch, Vendor Advisory
18372

Source: CONFIRM
Type: Patch
http://sourceforge.net/project/shownotes.php?release_id=384153&group_id=51417

Source: CCN
Type: SourceForge.net
About WebGUI

Source: MISC
Type: UNKNOWN
http://sourceforge.net/tracker/index.php?func=detail&aid=1395371&group_id=51417&atid=463213

Source: CCN
Type: OSVDB ID: 22289
WebGUI DataForm Entries XSS

Source: CCN
Type: PLAINBLACK Software Web site
Download - Plain Black Software, makers of WebGUI

Source: VUPEN
Type: UNKNOWN
ADV-2006-0126

Source: XF
Type: UNKNOWN
webgui-forms-xss(24053)

Source: XF
Type: UNKNOWN
webgui-forms-xss(24053)

Vulnerable Configuration:

Configuration 1:

cpe:/a:plain_black:webgui:5.5.8:*:*:*:*:*:*:*

OR cpe:/a:plain_black:webgui:6.2.10_gamma:*:*:*:*:*:*:*

OR cpe:/a:plain_black:webgui:6.2.11_gamma:*:*:*:*:*:*:*

OR cpe:/a:plain_black:webgui:6.3.0_beta:*:*:*:*:*:*:*

OR cpe:/a:plain_black:webgui:6.4.0_beta:*:*:*:*:*:*:*

OR cpe:/a:plain_black:webgui:6.5.0_beta:*:*:*:*:*:*:*

OR cpe:/a:plain_black:webgui:6.5.1_beta:*:*:*:*:*:*:*

OR cpe:/a:plain_black:webgui:6.5.2_beta:*:*:*:*:*:*:*

OR cpe:/a:plain_black:webgui:6.5.3_beta:*:*:*:*:*:*:*

OR cpe:/a:plain_black:webgui:6.5.4_gamma:*:*:*:*:*:*:*

OR cpe:/a:plain_black:webgui:6.5.5_gamma:*:*:*:*:*:*:*

OR cpe:/a:plain_black:webgui:6.5.6_gamma:*:*:*:*:*:*:*

OR cpe:/a:plain_black:webgui:6.6.0_beta:*:*:*:*:*:*:*

OR cpe:/a:plain_black:webgui:6.6.1_beta:*:*:*:*:*:*:*

OR cpe:/a:plain_black:webgui:6.6.2_gamma:*:*:*:*:*:*:*

OR cpe:/a:plain_black:webgui:6.6.3_gamma:*:*:*:*:*:*:*

OR cpe:/a:plain_black:webgui:6.6.4_gamma:*:*:*:*:*:*:*

OR cpe:/a:plain_black:webgui:6.6.5:*:*:*:*:*:*:*

OR cpe:/a:plain_black:webgui:6.7.0_beta:*:*:*:*:*:*:*

OR cpe:/a:plain_black:webgui:6.7.1_beta:*:*:*:*:*:*:*

OR cpe:/a:plain_black:webgui:6.7.2_beta:*:*:*:*:*:*:*

OR cpe:/a:plain_black:webgui:6.7.3_gamma:*:*:*:*:*:*:*

OR cpe:/a:plain_black:webgui:6.7.4_gamma:*:*:*:*:*:*:*

OR cpe:/a:plain_black:webgui:6.7.5_gamma:*:*:*:*:*:*:*

OR cpe:/a:plain_black:webgui:6.7.6_gamma:*:*:*:*:*:*:*

OR cpe:/a:plain_black:webgui:6.7.7_gamma:*:*:*:*:*:*:*

OR cpe:/a:plain_black:webgui:6.7.8_gamma:*:*:*:*:*:*:*

OR cpe:/a:plain_black:webgui:6.8.1_beta:*:*:*:*:*:*:*

OR cpe:/a:plain_black:webgui:6.8.2_beta:*:*:*:*:*:*:*

OR cpe:/a:plain_black:webgui:6.8.3_gamma:*:*:*:*:*:*:*

Denotes that component is vulnerable