CVE-2007-2235: XSS
First published: Wed Apr 25 2007(Updated: )
Multiple cross-site scripting (XSS) vulnerabilities in PunBB 1.2.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) Referer HTTP header to misc.php or the (2) category name when deleting a category in admin_categories.php.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| PunBB | <=1.2.14 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.acid-root.new.fr/advisories/13070411.txt
- http://dev.punbb.org/changeset/934
- http://dev.punbb.org/changeset/938
- http://secunia.com/advisories/24843
- http://securityreason.com/securityalert/2613
- http://www.vupen.com/english/advisories/2007/1362
- http://www.securityfocus.com/archive/1/465400/100/100/threaded
- http://www.securityfocus.com/archive/1/465338/100/100/threaded
Frequently Asked Questions
What is the severity of CVE-2007-2235?
CVE-2007-2235 has a medium severity rating due to its potential for exploitation via cross-site scripting.
How do I fix CVE-2007-2235?
To fix CVE-2007-2235, upgrade to PunBB version 1.3 or later, which addresses the XSS vulnerabilities.
What are the attack vectors for CVE-2007-2235?
Attack vectors for CVE-2007-2235 include injecting malicious scripts through the Referer HTTP header or by manipulating the category name during category deletion.
Which versions of PunBB are affected by CVE-2007-2235?
CVE-2007-2235 affects PunBB versions up to and including 1.2.14.
Can CVE-2007-2235 be exploited remotely?
Yes, CVE-2007-2235 can be exploited remotely by attackers to execute arbitrary scripts on user browsers.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/remedy
- agent/last-modified-date
- agent/author
- agent/first-publish-date
- agent/event
- agent/description
- agent/source
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/punbb
- canonical/punbb
- version/punbb/1.2.14