CVE-2004-2040: XSS
Multiple cross-site scripting (XSS) vulnerabilities in e107 0.615 allow remote attackers to inject arbitrary web script or HTML via the (1) LAN407 parameter to clockmenu.php, (2) "email article to a friend" field, (3) "submit news" field, or (4) avmsg parameter to usersettings.php.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2004-2040?
CVE-2004-2040 has a medium severity rating due to its potential to allow remote attackers to execute arbitrary web scripts or HTML through cross-site scripting.
How do I fix CVE-2004-2040?
To fix CVE-2004-2040, upgrade to a newer version of e107 that has addressed these cross-site scripting vulnerabilities.
What versions of e107 are affected by CVE-2004-2040?
CVE-2004-2040 affects e107 versions 0.6_15 and 0.6_15a.
What types of input are susceptible to CVE-2004-2040?
CVE-2004-2040 is vulnerable to XSS via the LAN_407 parameter in clock_menu.php, email article field, submit news field, and avmsg parameter in usersettings.php.
Can CVE-2004-2040 impact users' personal data?
Yes, CVE-2004-2040 can potentially impact users' personal data by allowing attackers to execute scripts that may steal sensitive information.