CVE-2004-1863: XSS
First published: Fri Dec 31 2004(Updated: )
Multiple cross-site scripting (XSS) vulnerabilities in XMB (aka extreme message board) 1.9 beta (aka Nexus beta) allow remote attackers to inject arbitrary web script or HTML via (1) the u2uheader parameter in editprofile.php, the restrict parameter in (2) member.php, (3) misc.php, and (4) today.php, and (5) an arbitrary parameter in phpinfo.php.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| XMB Forum | =1.9_beta | |
| XMB Forum | =1.8_sp3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/9983
- http://www.osvdb.org/14982
- http://www.osvdb.org/14989
- http://www.osvdb.org/14991
- http://www.osvdb.org/16884
- http://marc.info/?l=bugtraq&m=108032355905265&w=2
- https://exchange.xforce.ibmcloud.com/vulnerabilities/15654
- https://docs.xmbforum2.com/index.php?title=Security_Issue_History
Frequently Asked Questions
What is the severity of CVE-2004-1863?
CVE-2004-1863 is considered a medium severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2004-1863?
To fix CVE-2004-1863, it is recommended to upgrade XMB to the latest version that addresses these XSS vulnerabilities.
What types of attack vectors are associated with CVE-2004-1863?
CVE-2004-1863 includes attack vectors via the 'u2uheader' parameter in editprofile.php and multiple parameters in member.php, misc.php, and today.php.
Who is affected by CVE-2004-1863?
Users of XMB version 1.9 beta and 1.8 SP3 are affected by CVE-2004-1863.
What is the impact of exploiting CVE-2004-1863?
Exploiting CVE-2004-1863 can allow attackers to inject arbitrary web scripts or HTML into the affected XMB forums.
- agent/references
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/weakness
- agent/author
- agent/description
- agent/event
- agent/source
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/xmb forum
- canonical/xmb forum
- version/xmb forum/1.9_beta
- version/xmb forum/1.8_sp3