CVE-2004-2055: XSS
Published Jul 19, 2004
·Updated
Cross-site scripting (XSS) vulnerability in search.php for PhpBB 2.0.4 and 2.0.9 allows remote attackers to inject arbitrary HTMl or web script via the searchauthor parameter.
Affected Software
19 affected components
Phpbb Group Phpbb=2.0.5
Phpbb Group Phpbb=2.0.7a
Phpbb Group Phpbb=2.0.8
Phpbb Group Phpbb=2.0.1
Phpbb Group Phpbb=2.0.3
Phpbb Group Phpbb=2.0_rc2
Phpbb Group Phpbb=2.0_rc1
Phpbb Group Phpbb=2.0.4
Phpbb Group Phpbb=2.0.9
Phpbb Group Phpbb=2.0.7
Phpbb Group Phpbb=2.0.8a
Phpbb Group Phpbb=2.0.6d
Phpbb Group Phpbb=2.0.2
Phpbb Group Phpbb=2.0.6c
Phpbb Group Phpbb=2.0_rc4
Phpbb Group Phpbb=2.0.6
Phpbb Group Phpbb=2.0.0
Phpbb Group Phpbb=2.0_rc3
Phpbb Group Phpbb=2.0_beta1
Event History
Jul 19, 2004
CVE Published
04:00 AM
May 10, 2005
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2004-2055?
CVE-2004-2055 is classified as a medium severity vulnerability due to the potential for exploitation through cross-site scripting.
2
How do I fix CVE-2004-2055?
To fix CVE-2004-2055, upgrade your PhpBB installation to a version that is not affected, such as 2.0.10 or later.
3
Which versions are affected by CVE-2004-2055?
CVE-2004-2055 affects PhpBB versions 2.0.1 through 2.0.9.
4
What types of attacks can exploit CVE-2004-2055?
CVE-2004-2055 can be exploited to perform cross-site scripting attacks, allowing attackers to inject arbitrary HTML or web scripts.
5
Is there a workaround for CVE-2004-2055?
A temporary workaround for CVE-2004-2055 is to sanitize input from the search_author parameter until a software update can be applied.