CVE-2003-1453: XSS

Published Dec 31, 2003

Updated

Cross-site scripting (XSS) vulnerability in the MytextSanitizer function in XOOPS 1.3.5 through 1.3.9 and XOOPS 2.0 through 2.0.1 allows remote attackers to inject arbitrary web script or HTML via a javascript: URL in an IMG tag.

Affected Software

7 affected components

Xoops Xoops=1.3.5

Xoops Xoops=1.3.6

Xoops Xoops=1.3.7

Xoops Xoops=1.3.8

Xoops Xoops=1.3.9

Xoops Xoops=2.0

Xoops Xoops=2.0.1

Remediation

Patch Available

http://www.securityfocus.com/bid/7434

Event History

Dec 31, 2003

CVE Published

05:00 AM

Data Sourced

via NVD·05:00 AM

RemedyDescriptionSeverityWeaknessAffected Software

Oct 23, 2007

CVE Published

via MITRE·05:00 AM

Data Sourced

via MITRE·05:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2003-1453?

CVE-2003-1453 is classified as a high-severity cross-site scripting (XSS) vulnerability.

How do I fix CVE-2003-1453?

To fix CVE-2003-1453, update your XOOPS installation to a version that corrects the XSS vulnerability, such as 1.3.10 or later.

What versions of XOOPS are affected by CVE-2003-1453?

CVE-2003-1453 affects XOOPS versions 1.3.5 through 1.3.9 and 2.0 through 2.0.1.

What can attackers do with CVE-2003-1453?

Attackers can exploit CVE-2003-1453 to inject arbitrary web scripts or HTML through a vulnerable IMG tag.

Is there a workaround for CVE-2003-1453?

Implementing input validation and sanitization for user inputs that involve IMG tags can serve as a temporary workaround for CVE-2003-1453.