CVE-2007-5370: XSS

Published Oct 11, 2007

Updated

Multiple cross-site scripting (XSS) vulnerabilities in cgi-bin/dnewsweb.exe in NetWin DNewsWeb (DNews News Server) 57e1 allow remote attackers to inject arbitrary web script or HTML via the (1) group or (2) utag parameter.

Affected Software

1 affected component

Netwin dnewsweb=57e1

Event History

Oct 11, 2007

CVE Published

10:17 AM

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2007-5370?

The severity of CVE-2007-5370 is considered moderate due to its potential for cross-site scripting attacks.

How do I fix CVE-2007-5370?

To fix CVE-2007-5370, it is recommended to update to a patched version of NetWin DNewsWeb or implement input validation to sanitize the group and utag parameters.

What types of attacks are possible with CVE-2007-5370?

CVE-2007-5370 allows remote attackers to perform cross-site scripting (XSS) attacks by injecting arbitrary web scripts or HTML.

Which software is affected by CVE-2007-5370?

CVE-2007-5370 affects NetWin DNewsWeb version 57e1.

Can CVE-2007-5370 affect user sessions?

Yes, CVE-2007-5370 can affect user sessions by executing malicious scripts in the context of the user's browser.