CVE-2004-1862: XSS
First published: Fri Mar 26 2004(Updated: )
Multiple cross-site scripting (XSS) vulnerabilities in Extreme Messageboard (XMB) 1.8 SP3 and 1.9 beta allow remote attackers to inject arbitrary web script or HTML via the (1) xmbuser parameter to xmb.php, (2) folder parameter to u2u.php, (3) viewmost, replymost, or latest parameter to stats.php, (4) message or icons parameter to post.php, (5) threadlist, pagelinks, forumlist, navigation, or (6) forumdisplay parameter to forumdisplay.php.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| XMB Forum | =1.8_sp3 | |
| XMB Forum | =1.9_beta |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/9983
- http://osvdb.org/14983
- http://osvdb.org/14985
- http://osvdb.org/14986
- http://osvdb.org/14987
- http://osvdb.org/14988
- http://secunia.com/advisories/11230
- http://marc.info/?l=bugtraq&m=108032355905265&w=2
- https://exchange.xforce.ibmcloud.com/vulnerabilities/15654
- https://docs.xmbforum2.com/index.php?title=Security_Issue_History
Frequently Asked Questions
What is the severity of CVE-2004-1862?
CVE-2004-1862 has a medium severity rating due to its potential for exploitation via cross-site scripting attacks.
How do I fix CVE-2004-1862?
To remediate CVE-2004-1862, upgrade to the latest version of Extreme Messageboard that patches the XSS vulnerabilities.
What versions of XMB are affected by CVE-2004-1862?
CVE-2004-1862 affects Extreme Messageboard versions 1.8 SP3 and 1.9 beta.
What types of attacks can CVE-2004-1862 enable?
CVE-2004-1862 can enable remote attackers to conduct cross-site scripting attacks injecting arbitrary web scripts or HTML.
Is user data at risk with CVE-2004-1862?
Yes, CVE-2004-1862 can put user data at risk, as attackers may exploit it to steal session cookies or perform phishing attacks.
- agent/references
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/weakness
- agent/author
- agent/description
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- vendor/xmb forum
- canonical/xmb forum
- version/xmb forum/1.8_sp3
- version/xmb forum/1.9_beta