CVE-2007-6002: XSS

Q: Which products and versions are affected?

Fenrir Sleipnir 2.5.17 R2 and earlier, and Fenrir Grani 3.0 and earlier, are affected.

Q: What must an attacker do to exploit the issue?

An attacker must supply malicious script or HTML through the Search field when searching for additions to the Favorites section. The issue can be exploited remotely and requires no authentication.

Q: What is the impact of successful exploitation?

Successful exploitation allows injection of arbitrary web script or HTML. The provided severity vector indicates an integrity impact, with no listed confidentiality or availability impact.

Q: What should organizations do to remediate this vulnerability?

Apply the available patch. The provided data does not identify any alternative mitigation if patching cannot be performed immediately.

Published Nov 15, 2007

Updated

Cross-site scripting (XSS) vulnerability in Fenriru (1) Sleipnir 2.5.17 R2 and earlier and (2) Grani 3.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the Search field in a search for additions to the Favorites section.

Affected Software

2 affected components

Fenrir Grani<=3.0

Fenrir Sleipnir<=2.5.17

Remediation

Event History

Nov 15, 2007

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

Description

Frequently Asked Questions

Which products and versions are affected?

Fenrir Sleipnir 2.5.17 R2 and earlier, and Fenrir Grani 3.0 and earlier, are affected.

What must an attacker do to exploit the issue?

An attacker must supply malicious script or HTML through the Search field when searching for additions to the Favorites section. The issue can be exploited remotely and requires no authentication.

What is the impact of successful exploitation?

Successful exploitation allows injection of arbitrary web script or HTML. The provided severity vector indicates an integrity impact, with no listed confidentiality or availability impact.

What should organizations do to remediate this vulnerability?

Apply the available patch. The provided data does not identify any alternative mitigation if patching cannot be performed immediately.

CVE-2007-6002: XSS

Affected Software

Remediation

Patch Available

Patch Available

Patch Available

Event History

Frequently Asked Questions

Which products and versions are affected?

What must an attacker do to exploit the issue?

What is the impact of successful exploitation?

What should organizations do to remediate this vulnerability?

Company

Resources

Contact

Frequently Asked Questions

Which products and versions are affected?

What must an attacker do to exploit the issue?

What is the impact of successful exploitation?

What should organizations do to remediate this vulnerability?