CVE-2006-3484: XSS
Multiple cross-site scripting (XSS) vulnerabilities in ATutor before 1.5.3 allow remote attackers to inject arbitrary web script or HTML via the (1) showcourses or (2) currentcat parameters to (a) admin/createcourse.php, showcourses parameter to (b) users/createcourse.php, (3) p parameter to (c) documentation/admin/, (4) forgot parameter to (d) passwordreminder.php, (5) cat parameter to (e) users/browse.php, or the (6) submit parameter to admin/fixcontent.php.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2006-3484?
CVE-2006-3484 is classified as a medium severity vulnerability due to its potential to enable cross-site scripting attacks.
How do I fix CVE-2006-3484?
To fix CVE-2006-3484, upgrade ATutor to version 1.5.3 or later which addresses these vulnerabilities.
What versions of ATutor are affected by CVE-2006-3484?
CVE-2006-3484 affects ATutor versions 1.5.1, 1.5.1_pl1, 1.5.1_pl2, and 1.5.3_rc2.
What types of attacks can CVE-2006-3484 allow?
CVE-2006-3484 allows remote attackers to execute arbitrary web scripts or HTML through XSS attacks.
Is user input validation implemented in ATutor prior to version 1.5.3 for CVE-2006-3484?
No, inadequate user input validation in ATutor prior to version 1.5.3 contributes to the vulnerabilities identified in CVE-2006-3484.