CVE-2009-1937: XSS

Published Jun 5, 2009

Updated

Cross-site scripting (XSS) vulnerability in the comment posting feature in LightNEasy 2.2.1 "no database" (aka flat) and 2.2.2 SQLite allows remote attackers to inject arbitrary web script or HTML via the (1) commentname (aka Author), (2) commentemail (aka Email), and (3) commentmessage (aka Comment) parameters. NOTE: some of these details are obtained from third party information.

Affected Software

2 affected components

LightNEasy LightNEasy=2.2.2

LightNEasy LightNEasy=2.2.1

Event History

Jun 5, 2009

CVE Published

via MITRE·06:13 PM

Data Sourced

via MITRE·06:13 PM

Description

Frequently Asked Questions

What is the severity of CVE-2009-1937?

CVE-2009-1937 is considered a medium severity vulnerability due to its potential for exploitation through cross-site scripting.

How do I fix CVE-2009-1937?

To fix CVE-2009-1937, sanitize input fields for commentname, commentemail, and commentmessage to prevent HTML and script injection.

Which versions of LightNEasy are affected by CVE-2009-1937?

CVE-2009-1937 affects LightNEasy versions 2.2.1 and 2.2.2.

What type of vulnerability is CVE-2009-1937?

CVE-2009-1937 is a cross-site scripting (XSS) vulnerability on the comment posting feature.

Can CVE-2009-1937 allow attackers to execute scripts?

Yes, CVE-2009-1937 allows remote attackers to inject arbitrary web scripts or HTML.