CVE-2006-6197: XSS
Multiple cross-site scripting (XSS) vulnerabilities in b2evolution 1.8.2 through 1.9 beta allow remote attackers to inject arbitrary web script or HTML via the (1) appname parameter in (a) 404notfound.page.php, (b) 410statsgone.page.php, and (c) refererspam.page.php in inc/VIEW/errors/; the (2) baseurl parameter in (d) inc/VIEW/errors/404notfound.page.php; and the (3) ReqURI parameter in (e) inc/VIEW/errors/refererspam.page.php.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2006-6197?
CVE-2006-6197 is classified as a moderate severity vulnerability due to its cross-site scripting (XSS) risks.
How do I fix CVE-2006-6197?
To fix CVE-2006-6197, update your b2evolution installation to version 1.9 or later where the vulnerabilities are resolved.
What versions of b2evolution are affected by CVE-2006-6197?
CVE-2006-6197 affects b2evolution versions 1.8.2 through 1.9 beta.
What kind of attack can be executed through CVE-2006-6197?
CVE-2006-6197 allows remote attackers to perform cross-site scripting (XSS) attacks by injecting arbitrary web scripts or HTML.
Where in the b2evolution code do the vulnerabilities related to CVE-2006-6197 exist?
The vulnerabilities related to CVE-2006-6197 exist in the app_name parameter of the _404_not_found.page.php, _410_stats_gone.page.php, and _referer_spam.page.php files.