CVE-2005-0266: XSS

Published Jan 1, 2005

Updated

Cross-site scripting (XSS) vulnerability in index.php in SugarCRM 1.X allows remote attackers to inject arbitrary web script or HTML via the (1) returnmodule, (2) returnaction, (3) name, (4) module, or (5) record parameter.

Affected Software

13 affected components

SugarCRM SugarCRM=1.5d

SugarCRM SugarCRM=1.1a

SugarCRM SugarCRM=1.1b

SugarCRM SugarCRM=1.0g

SugarCRM SugarCRM=1.1e

SugarCRM SugarCRM=2.0.1

SugarCRM SugarCRM=1.1c

SugarCRM SugarCRM=1.1f

SugarCRM SugarCRM=1.0

SugarCRM SugarCRM=2.0.1a

SugarCRM SugarCRM=1.1d

SugarCRM SugarCRM=1.0f

SugarCRM SugarCRM=1.1

Event History

Jan 1, 2005

CVE Published

05:00 AM

Feb 10, 2005

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2005-0266?

CVE-2005-0266 is classified as a medium severity cross-site scripting (XSS) vulnerability.

How do I fix CVE-2005-0266?

To fix CVE-2005-0266, upgrade to a patched version of SugarCRM that addresses the XSS issue.

Which versions of SugarCRM are affected by CVE-2005-0266?

CVE-2005-0266 affects SugarCRM versions 1.0 to 2.0.1, including various sub-versions like 1.1a, 1.1b, and 1.5d.

What types of attacks can be executed due to CVE-2005-0266?

CVE-2005-0266 allows remote attackers to inject arbitrary web scripts or HTML into the application.

Is user input sanitization sufficient to mitigate CVE-2005-0266?

While user input sanitization is a good practice, it alone may not be sufficient to fully mitigate CVE-2005-0266 without applying updates or patches to the software.