CVE-2005-2204: XSS
First published: Mon Jul 11 2005(Updated: )
Cross-site scripting (XSS) vulnerability in Computer Associates (CA) eTrust SiteMinder 5.5, when the "CSSChecking" parameter is set to "NO," allows remote attackers to inject arbitrary web script or HTML via the (1) PASSWORD or (2) BUFFER parameters to smpwservicescgi.exe, (3) the TARGET parameter to login.fcc, and possibly other vectors.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| CA SiteMinder | =5.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://securitytracker.com/id?1014433
- http://www.osvdb.org/17809
- http://www.osvdb.org/17810
- http://secunia.com/advisories/15956
- http://www.vupen.com/english/advisories/2005/1040
- http://marc.info/?l=bugtraq&m=112110963416714&w=2
- http://marc.info/?l=bugtraq&m=112084050624959&w=2
- https://exchange.xforce.ibmcloud.com/vulnerabilities/21305
Frequently Asked Questions
What is the severity of CVE-2005-2204?
CVE-2005-2204 is classified as a moderate severity vulnerability as it allows for cross-site scripting attacks.
How do I fix CVE-2005-2204?
To mitigate CVE-2005-2204, ensure that the 'CSSChecking' parameter is set to 'YES' and apply security patches from Broadcom.
What software is affected by CVE-2005-2204?
CVE-2005-2204 affects CA eTrust SiteMinder version 5.5.
What types of parameters can be exploited in CVE-2005-2204?
CVE-2005-2204 can be exploited through the PASSWORD, BUFFER, and TARGET parameters in smpwservicescgi.exe.
What impact does CVE-2005-2204 have on users?
CVE-2005-2204 can allow attackers to inject arbitrary web scripts or HTML, potentially compromising user data and sessions.
- agent/references
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/weakness
- agent/author
- agent/severity
- agent/description
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- vendor/broadcom
- canonical/ca siteminder
- version/ca siteminder/5.5