CVE-2005-3547: XSS
First published: Wed Nov 16 2005(Updated: )
Cross-site scripting (XSS) vulnerability in Invision Power Board 2.1 allows remote attackers to inject arbitrary web script or HTML via the (1) adsess, (2) name, and (3) description parameters in admin.php, and the (4) ACP Notes, (5) Member Name, (6) Password, (7) Email Address, (8) Components, and multiple other input fields.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Invisioncommunity Invision Power Board | =2.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://benji.redkod.org/audits/ipb.2.1.pdf
- http://secunia.com/advisories/17443
- http://www.securityfocus.com/bid/15344
- http://www.securityfocus.com/bid/15345
- http://osvdb.org/20516
- http://osvdb.org/20517
- http://osvdb.org/20518
- http://osvdb.org/20519
- http://osvdb.org/20520
- http://osvdb.org/20521
- http://osvdb.org/20522
- https://exchange.xforce.ibmcloud.com/vulnerabilities/22999
- http://www.securityfocus.com/archive/1/415801/30/0/threaded
Frequently Asked Questions
What is the severity of CVE-2005-3547?
CVE-2005-3547 is considered a medium to high severity vulnerability due to its potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2005-3547?
To fix CVE-2005-3547, update Invision Power Board to a version that is not affected by this XSS vulnerability.
What are the affected parameters in CVE-2005-3547?
CVE-2005-3547 affects the adsess, name, description parameters in admin.php, and various fields such as ACP Notes, Member Name, Password, and Email Address.
Can CVE-2005-3547 lead to unauthorized actions on the site?
Yes, CVE-2005-3547 can allow remote attackers to inject scripts that could perform unauthorized actions on behalf of users.
Is CVE-2005-3547 easy to exploit?
CVE-2005-3547 can be exploited easily if the site does not properly validate user input, making it particularly concerning for vulnerable sites.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/severity
- agent/weakness
- agent/remedy
- agent/author
- agent/last-modified-date
- agent/event
- agent/description
- agent/first-publish-date
- agent/source
- agent/tags
- collector/nvd-historical
- vendor/invision power services
- product/invision board
- canonical/invision power services invision board
- agent/software-canonical-lookup-request
- collector/nvd-index
- canonical/invisioncommunity invision power board
- version/invisioncommunity invision power board/2.1