CVE-2006-2178

Multiple cross-site scripting (XSS) vulnerabilities in CyberBuild allow remote attackers to inject arbitrary web script or HTML via the (1) SessionID parameter to login.asp, (2) ProductIndex parameter to browse0.htm, (3) rowcolor parameter to result.asp, or (4) heading parameter to result.asp. NOTE: vectors 1 and 2 might be resultant from SQL injection.

Published Bycve@mitre.org

Published DateMay 04, 2006, 12:38

Weakness Type (CWE):CWE-79

CVSS Metrics

Base Score

5.8

Vector String

AV:N/AC:M/Au:N/C:P/I:P/A:N

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

PARTIAL

Integrity (I)

PARTIAL

Availability (A)

NONE

References

http://pridels0.blogspot.com/2006/05/cyberbuild-vuln.html
http://secunia.com/advisories/19889
http://www.osvdb.org/25197
http://www.osvdb.org/25198
http://www.osvdb.org/25199
http://www.securityfocus.com/bid/17829
http://www.vupen.com/english/advisories/2006/1630
https://exchange.xforce.ibmcloud.com/vulnerabilities/26202

Weakness Type (CWE):CWE-79

CVSS Metrics

Base Score

5.8

Vector String

AV:N/AC:M/Au:N/C:P/I:P/A:N

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

PARTIAL

Integrity (I)

PARTIAL

Availability (A)

NONE