CVE-2005-3152: XSS

Published Oct 5, 2005

Updated

Multiple cross-site scripting (XSS) vulnerabilities in CubeCart 3.0.3 allow remote attackers to inject arbitrary web script or HTML via the redir parameter to (1) cart.php or (2) index.php, or (3) the searchStr parameter in a viewCat action to index.php. Note: vectors (1) and (2) were later reported to affect 3.0.7-pl1.

Affected Software

2 affected components

Devellion CubeCart=3.0.3

Devellion CubeCart=3.0.7-pl1

Remediation

Patch Available

http://www.securityfocus.com/bid/14962

Event History

Oct 5, 2005

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2005-3152?

CVE-2005-3152 is considered to be a medium severity vulnerability due to its potential for cross-site scripting attacks.

How do I fix CVE-2005-3152?

To fix CVE-2005-3152, update to a patched version of CubeCart, specifically version 3.0.7-pl1 or later.

What are the affected versions for CVE-2005-3152?

CVE-2005-3152 affects CubeCart versions 3.0.3 and 3.0.7-pl1.

What type of attacks does CVE-2005-3152 enable?

CVE-2005-3152 enables attackers to perform cross-site scripting (XSS) attacks.

Which parameters are vulnerable in CVE-2005-3152?

CVE-2005-3152 affects the redir parameter in cart.php and index.php, and the searchStr parameter in a viewCat action to index.php.