CVE-2002-2235: XSS
Published Dec 31, 2002
·Updated
member2.php in vBulletin 2.2.9 and earlier does not properly restrict the $perpage variable to be an integer, which causes an error message to be reflected back to the user without quoting, which facilitates cross-site scripting (XSS) and possibly other attacks.
Affected Software
14 affected components
Jelsoft vBulletin=2.2.0
Jelsoft vBulletin=2.2.9_can
Jelsoft vBulletin=2.2.1
Jelsoft vBulletin=2.0.2
Jelsoft vBulletin=2.0
Jelsoft vBulletin=2.0.1
Jelsoft vBulletin=2.2.7
Jelsoft vBulletin=2.2.4
Jelsoft vBulletin=2.2.2
Jelsoft vBulletin=2.2.5
Jelsoft vBulletin=2.2.6
Jelsoft vBulletin=2.2.9
Jelsoft vBulletin=2.2.8
Jelsoft vBulletin=2.2.3
Event History
Dec 31, 2002
CVE Published
05:00 AM
Data Sourced
via NVD·05:00 AM
DescriptionSeverityWeaknessAffected Software
Oct 15, 2007
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2002-2235?
CVE-2002-2235 is classified as a cross-site scripting (XSS) vulnerability.
2
How does CVE-2002-2235 affect vBulletin software?
CVE-2002-2235 allows attackers to exploit the improper handling of the $perpage variable, potentially enabling XSS attacks.
3
Which versions of vBulletin are affected by CVE-2002-2235?
CVE-2002-2235 affects vBulletin versions 2.2.9 and earlier.
4
How do I fix CVE-2002-2235?
To fix CVE-2002-2235, ensure that the $perpage variable is properly validated to accept only integer values.
5
Can CVE-2002-2235 lead to other attacks besides XSS?
Yes, CVE-2002-2235 could facilitate other types of attacks due to the reflected error messages.