CVE-2008-2196: XSS

Published May 14, 2008

Updated

Cross-site scripting (XSS) vulnerability in admin.php in LifeType 1.2.8 allows remote attackers to inject arbitrary web script or HTML via the newBlogUserName parameter in an addBlogUser action, a different vector than CVE-2008-2178.

Affected Software

1 affected component

Lifetype LifeType=1.2.8

Event History

May 14, 2008

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Frequently Asked Questions

Who is exposed to this issue?

LifeType 1.2.8 deployments are affected. The vulnerable functionality is in admin.php when handling the addBlogUser action.

What does an attacker need to exploit it?

The attacker must be able to send a request to admin.php that invokes the addBlogUser action and supplies malicious script or HTML in the newBlogUserName parameter. The issue is remotely exploitable and requires no authentication according to the provided CVSS vector.

What is the impact of successful exploitation?

Successful exploitation can inject arbitrary web script or HTML. The provided severity vector indicates an integrity impact, with no stated confidentiality or availability impact.