CVE-2004-2402: XSS

Published Dec 31, 2004

Updated

Cross-site scripting (XSS) vulnerability in YaBB.pl in YaBB 1 GOLD SP 1.3.2 allows remote attackers to inject arbitrary web script or HTML via a hex-encoded to parameter. NOTE: some sources say that the board parameter is affected, but this is incorrect.

Affected Software

10 affected components

Yabb Yabb=2000-09-11

Yabb Yabb=1.40

Yabb Yabb=1_gold_-_sp_1

Yabb Yabb=1_gold_-_sp_1.3.2

Yabb Yabb=1_gold_-_sp_1.3

Yabb Yabb=2000-09-01

Yabb Yabb=1_gold_-_sp_1.2

Yabb Yabb=1.41

Yabb Yabb=1_gold_release

Yabb Yabb=1_gold_-_sp_1.3.1

Event History

Dec 31, 2004

CVE Published

05:00 AM

Aug 17, 2005

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2004-2402?

CVE-2004-2402 is considered a moderate severity vulnerability due to its potential for cross-site scripting attacks.

How do I fix CVE-2004-2402?

To fix CVE-2004-2402, upgrade to YaBB versions that do not contain this vulnerability or apply security patches provided by the vendor.

What versions of YaBB are affected by CVE-2004-2402?

CVE-2004-2402 affects YaBB 1 GOLD SP 1.3.2 and earlier versions.

What attack vectors are associated with CVE-2004-2402?

CVE-2004-2402 allows remote attackers to inject arbitrary web scripts or HTML through a vulnerable parameter.

Can CVE-2004-2402 be exploited by an attacker without authentication?

Yes, an attacker can exploit CVE-2004-2402 without requiring authentication, making it a potential risk for any YaBB instance.