CVE-2005-2112: XSS
Published Jul 1, 2005
·Updated
Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 2.0.11 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) order parameter to edit.php or (2) cid parameter to commentedit.php.
Affected Software
15 affected components
Xoops Xoops=2.0
Xoops Xoops=2.0.1
Xoops Xoops=2.0.2
Xoops Xoops=2.0.3
Xoops Xoops=2.0.4
Xoops Xoops=2.0.5
Xoops Xoops=2.0.5.1
Xoops Xoops=2.0.5.2
Xoops Xoops=2.0.6
Xoops Xoops=2.0.7
Xoops Xoops=2.0.9
Xoops Xoops=2.0.9.2
Xoops Xoops=2.0.9.3
Xoops Xoops=2.0.10
Xoops Xoops=2.0.11
Remediation
Patch Available
Event History
Jul 1, 2005
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2005-2112?
CVE-2005-2112 has a medium severity rating due to its potential for cross-site scripting attacks.
2
How do I fix CVE-2005-2112?
To fix CVE-2005-2112, upgrade to a version of XOOPS later than 2.0.11 that addresses the cross-site scripting vulnerabilities.
3
What versions of XOOPS are affected by CVE-2005-2112?
CVE-2005-2112 affects XOOPS versions 2.0.11 and earlier.
4
Can CVE-2005-2112 be exploited remotely?
Yes, CVE-2005-2112 can be exploited remotely by attackers to inject arbitrary web scripts or HTML.
5
What are the typical attack vectors for CVE-2005-2112?
The typical attack vectors for CVE-2005-2112 include manipulating the 'order' parameter in edit.php and the 'cid' parameter in comment_edit.php.