CVE-2008-2178: XSS
Published May 13, 2008
·Updated
Cross-site scripting (XSS) vulnerability in admin.php in LifeType 1.2.7 allows remote attackers to inject arbitrary web script or HTML via the searchTerms parameter in an editArticleCategories operation (aka an admin category search).
Affected Software
1 affected component
Lifetype LifeType=1.2.7
Remediation
Patch Available
Patch Available
Patch Available
Event History
May 13, 2008
CVE Published
via MITRE·10:00 PM
Data Sourced
via MITRE·10:00 PM
Description
Frequently Asked Questions
1
Which users are most likely to be exposed to this issue?
Users who access the LifeType administrative category-search function are the relevant target population. The vulnerable request is the editArticleCategories operation in admin.php.
2
What does an attacker need to exploit the vulnerability?
An attacker can act remotely and does not need authentication, but exploitation requires crafting input in the searchTerms parameter that is processed by the administrative category search.
3
Is a fix available?
Yes. A patch is available, and LifeType 1.2.8 was released in connection with the issue.