CVE-2005-1945: XSS

Published Jun 9, 2005

Updated

Cross-site scripting (XSS) vulnerability in the converthighlitewords function in Invision Blog before 1.1.2 Final allows remote attackers to inject arbitrary web script or HTML via double hex encoded highlight data.

Affected Software

2 affected components

Invision Power Services Invision Community Blog=1.0

Invision Power Services Invision Community Blog=1.1

Remediation

Patch Available

http://www.gulftech.org/?node=research&article_id=00078-06072005

Event History

Jun 9, 2005

CVE Published

04:00 AM

Jun 14, 2005

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2005-1945?

CVE-2005-1945 is considered a moderate severity vulnerability due to its potential for cross-site scripting attacks.

How does CVE-2005-1945 work?

CVE-2005-1945 allows attackers to inject arbitrary web scripts or HTML through the convert_highlite_words function by exploiting double hex encoded highlight data.

Which versions of Invision Blog are affected by CVE-2005-1945?

CVE-2005-1945 affects Invision Blog versions 1.0 and 1.1 before the 1.1.2 Final release.

How do I fix CVE-2005-1945?

To fix CVE-2005-1945, upgrade Invision Blog to version 1.1.2 Final or later.

Can CVE-2005-1945 be exploited remotely?

Yes, CVE-2005-1945 can be exploited remotely, allowing attackers to execute scripts in the context of a victim's session.