CVE-2005-0477: XSS

Published Feb 19, 2005

Updated

Cross-site scripting (XSS) vulnerability in the SML code for Invision Power Board 1.3.1 FINAL allows remote attackers to inject arbitrary web script via (1) a signature file or (2) a message post containing an IMG tag within a COLOR tag whose style is set to background:url.

Affected Software

8 affected components

Invision Power Services Invision Power Board=1.0

Invision Power Services Invision Power Board=1.0.1

Invision Power Services Invision Power Board=1.1.1

Invision Power Services Invision Power Board=1.1.2

Invision Power Services Invision Power Board=1.2

Invision Power Services Invision Power Board=1.3

Invision Power Services Invision Power Board=1.3.1_final

Invision Power Services Invision Power Board=1.3_final

Event History

Feb 19, 2005

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2005-0477?

The severity of CVE-2005-0477 is classified as medium due to its potential to allow cross-site scripting attacks.

How do I fix CVE-2005-0477?

To fix CVE-2005-0477, upgrade to a patched version of Invision Power Board that addresses this vulnerability.

What versions of Invision Power Board are affected by CVE-2005-0477?

CVE-2005-0477 affects Invision Power Board versions 1.0, 1.0.1, 1.1.1, 1.1.2, 1.2, 1.3, and 1.3.1 FINAL.

What kind of attack can be executed through CVE-2005-0477?

CVE-2005-0477 allows remote attackers to execute cross-site scripting (XSS) attacks by injecting arbitrary web scripts.

Is user input involved in the exploitation of CVE-2005-0477?

Yes, the exploitation of CVE-2005-0477 involves user input through signature files or message posts that can contain malicious IMG tags.