CVE-2005-4621: XSS

Published Dec 31, 2005

Updated

Cross-site scripting (XSS) vulnerability in the editavatar page in vBulletin 3.5.1 allows remote attackers to inject arbitrary web script or HTML via a URL in the remote avatar url field, in which the URL generates a parsing error, and possibly requiring a trailing extension such as .jpg.

Affected Software

38 affected components

Jelsoft vBulletin=2.2.0

Jelsoft vBulletin=2.0_rc2

Jelsoft vBulletin=3.0.4

Jelsoft vBulletin=3.0_beta_6

Jelsoft vBulletin=2.3.0

Jelsoft vBulletin=2.3.8

Jelsoft vBulletin=2.3.2

Jelsoft vBulletin=3.0.1

Jelsoft vBulletin=3.5.1

Jelsoft vBulletin=2.0_rc3

Jelsoft vBulletin=3.0.6

Jelsoft vBulletin=2.2.1

Jelsoft vBulletin=2.2.7

Jelsoft vBulletin=2.0.3

Jelsoft vBulletin=3.0_beta_7

Jelsoft vBulletin=3.0.9

Jelsoft vBulletin=3.0_beta_3

Jelsoft vBulletin=2.2.4

Jelsoft vBulletin=3.0_beta_2

Jelsoft vBulletin=2.2.2

Jelsoft vBulletin=2.2.5

Jelsoft vBulletin=2.2.6

Jelsoft vBulletin=3.0.2

Jelsoft vBulletin=3.0_gamma

Jelsoft vBulletin=2.2.9

Jelsoft vBulletin=3.0.7

Jelsoft vBulletin=3.0.10

Jelsoft vBulletin=3.0.8

Jelsoft vBulletin=3.0_beta_4

Jelsoft vBulletin=3.0.3

Jelsoft vBulletin=1.0.1

Jelsoft vBulletin=3.0.5

Jelsoft vBulletin=2.2.8

Jelsoft vBulletin=2.3.4

Jelsoft vBulletin=2.2.3

Jelsoft vBulletin=3.0

Jelsoft vBulletin=3.0_beta_5

Jelsoft vBulletin=2.3.3

Remediation

Patch Available

http://www.vbulletin.com/forum/showthread.php?t=166391

Event History

Dec 31, 2005

CVE Published

05:00 AM

Jan 6, 2006

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2005-4621?

The severity of CVE-2005-4621 is considered medium as it allows for cross-site scripting attacks.

How do I fix CVE-2005-4621?

To fix CVE-2005-4621, you should upgrade to a patched version of vBulletin that addresses this vulnerability.

What systems are affected by CVE-2005-4621?

CVE-2005-4621 affects vBulletin versions 3.5.1 and earlier, including various 2.x series versions.

What types of attacks can CVE-2005-4621 enable?

CVE-2005-4621 can enable attackers to execute arbitrary web scripts on the browsers of users who view affected pages.

When was CVE-2005-4621 discovered?

CVE-2005-4621 was discovered and made public in December 2005.