| Vulnerability Name: | CVE-2008-2553 (CCN-42882) | ||||||||||||||||
| Assigned: | 2008-01-04 | ||||||||||||||||
| Published: | 2008-01-04 | ||||||||||||||||
| Updated: | 2017-08-08 | ||||||||||||||||
| Summary: | Cross-site scripting (XSS) vulnerability in Slashdot Like Automated Storytelling Homepage (Slash) (aka Slashcode) R_2_5_0_94 and earlier allows remote attackers to inject arbitrary web script or HTML via the userfield parameter. | ||||||||||||||||
| CVSS v3 Severity: | 5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
| ||||||||||||||||
| CVSS v2 Severity: | 4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N) 3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)
| ||||||||||||||||
| Vulnerability Type: | CWE-79 | ||||||||||||||||
| Vulnerability Consequences: | Gain Access | ||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2008-2553 Source: CCN Type: SA30551 Slash Cross-Site Scripting and SQL Injection Source: SECUNIA Type: Vendor Advisory 30551 Source: SECUNIA Type: UNKNOWN 31691 Source: CCN Type: SECTRACK ID: 1020207 Slash Input Validation Hole in 'userfield' Parameter Permits Cross-Site Scripting Attacks Source: CCN Type: SourceForge.net Repository Diff of /slash/Slash/Utility/Environment/Environment.pm Source: CONFIRM Type: UNKNOWN http://slashcode.cvs.sourceforge.net/slashcode/slash/Slash/Utility/Environment/Environment.pm?r1=1.223&r2=1.225 Source: DEBIAN Type: UNKNOWN DSA-1633 Source: DEBIAN Type: DSA-1633 slash -- SQL Injection Source: CCN Type: OSVDB ID: 46253 Slash userfield Parameter XSS Source: BID Type: UNKNOWN 29548 Source: CCN Type: BID-29548 Slashcode Slash 'Environment.pm' Multiple Input Validation Vulnerabilities Source: SECTRACK Type: UNKNOWN 1020207 Source: CONFIRM Type: UNKNOWN http://www.slashcode.com/article.pl?sid=08/01/04/1950244&tid=4 Source: CCN Type: Slashcode Web Site Full disclosure on Friday's security issue, and new patch Source: CONFIRM Type: UNKNOWN http://www.slashcode.com/article.pl?sid=08/01/07/2314232 Source: XF Type: UNKNOWN slash-userfield-xss(42882) Source: XF Type: UNKNOWN slash-userfield-xss(42882) | ||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Denotes that component is vulnerable | ||||||||||||||||
| Oval Definitions | |||||||||||||||||
| |||||||||||||||||
| BACK | |||||||||||||||||