CVE-2014-9468: XSS

Published Feb 19, 2015

Updated

Multiple cross-site scripting (XSS) vulnerabilities in InstantASP InstantForum.NET 4.1.3, 4.1.2, 4.1.1, 4.0.0, 4.1.0, and 3.4.0 allow remote attackers to inject arbitrary web script or HTML via the SessionID parameter to (1) Join.aspx or (2) Logon.aspx.

Affected Software

5 affected components

InstantASP InstantForum=3.4.0

InstantASP InstantForum=4.1.0

InstantASP InstantForum=4.1.1

InstantASP InstantForum=4.1.2

InstantASP InstantForum=4.1.3

Event History

Feb 19, 2015

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Frequently Asked Questions

Which endpoints are affected by the vulnerable parameter?

The issue is exposed through the SessionID parameter on Join.aspx and Logon.aspx.

Does exploitation require an authenticated account?

No. The published CVSS vector lists authentication as not required (Au:N), so a remote unauthenticated attacker can attempt exploitation.

What impact can successful exploitation have?

The reported impact is integrity impact only (I:P), with no stated confidentiality or availability impact. An attacker can inject arbitrary web script or HTML.

Which InstantForum.NET versions are identified as affected?

The affected versions listed are 3.4.0, 4.0.0, 4.1.0, 4.1.1, 4.1.2, and 4.1.3.

CVE-2014-9468: XSS

Affected Software

Event History

Frequently Asked Questions

Which endpoints are affected by the vulnerable parameter?

Does exploitation require an authenticated account?

What impact can successful exploitation have?

Which InstantForum.NET versions are identified as affected?

Company

Resources

Contact

Frequently Asked Questions

Which endpoints are affected by the vulnerable parameter?

Does exploitation require an authenticated account?

What impact can successful exploitation have?

Which InstantForum.NET versions are identified as affected?