CVE-2004-0322: XSS
First published: Mon Feb 23 2004(Updated: )
Multiple cross-site scripting (XSS) vulnerabilities in XMB 1.8 Final SP2 allow remote attackers to execute arbitrary script as other users via the (1) member parameter in member.php, (2) uid parameter in u2uadmin.php, (3) user parameter in editprofile.php, (4) an onmouseover event in an align tag when bbcode is allowed, or (5) img tag where bbcode is allowed.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| XMB Forum | =1.8_sp1 | |
| XMB Forum | =1.8 | |
| XMB Forum | =1.8_sp2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/9726
- http://archives.neohapsis.com/archives/bugtraq/2004-02/0645.html
- http://www.xmbforum.com/community/boards/viewthread.php?tid=746859
- http://marc.info/?l=bugtraq&m=107756526625179&w=2
- https://exchange.xforce.ibmcloud.com/vulnerabilities/15294
- https://exchange.xforce.ibmcloud.com/vulnerabilities/15292
- https://docs.xmbforum2.com/index.php?title=Security_Issue_History
Frequently Asked Questions
What is the severity of CVE-2004-0322?
CVE-2004-0322 is classified as a medium severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2004-0322?
To fix CVE-2004-0322, upgrade to XMB Forum version 1.8 Final SP3 or later, which addresses these XSS vulnerabilities.
What systems are affected by CVE-2004-0322?
CVE-2004-0322 affects XMB Forum versions 1.8 and 1.8 SP1 and SP2.
What types of attacks can be executed through CVE-2004-0322?
CVE-2004-0322 allows remote attackers to execute arbitrary JavaScript code in the context of another user's session.
Is there a workaround for CVE-2004-0322?
A temporary workaround for CVE-2004-0322 involves validating and sanitizing user input for affected parameters in the application.
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/last-modified-date
- agent/remedy
- agent/author
- agent/weakness
- agent/severity
- agent/description
- agent/event
- agent/source
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/xmb forum
- canonical/xmb forum
- version/xmb forum/1.8_sp1
- version/xmb forum/1.8
- version/xmb forum/1.8_sp2