CVE-2007-2248 - Vulnerability Details - OpenCVE

Multiple cross-site scripting (XSS) vulnerabilities in admin.php in Phorum before 5.1.22 allow remote attackers to inject arbitrary web script or HTML via the (1) group_id parameter in the groups module or (2) the smiley_id parameter in the smileys modsettings module.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Phorum	Phorum

Configuration 1 [-]

cpe:2.3:a:phorum:phorum:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://osvdb.org/35057
http://osvdb.org/35058
http://secunia.com/advisories/24932
http://securityreason.com/securityalert/2617
http://www.phorum.org/story.php?76
http://www.securityfocus.com/archive/1/466286/100/0/threaded
http://www.securityfocus.com/bid/23616
http://www.securitytracker.com/id?1017936
http://www.waraxe.us/advisory-49.html

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2007-04-25T16:00:00

Updated: 2024-08-07T13:33:28.260Z

Reserved: 2007-04-25T00:00:00

Link: CVE-2007-2248

Vulnrichment

No data.

NVD

Status : Modified

Published: 2007-04-25T16:19:00.000

Modified: 2024-11-21T00:30:17.930

Link: CVE-2007-2248

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2007-04-19T00:00:00", "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in admin.php in Phorum before 5.1.22 allow remote attackers to inject arbitrary web script or HTML via the (1) group_id parameter in the groups module or (2) the smiley_id parameter in the smileys modsettings module."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-16T14:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "http://www.waraxe.us/advisory-49.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.phorum.org/story.php?76"}, {"name": "1017936", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id?1017936"}, {"name": "24932", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/24932"}, {"name": "35058", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/35058"}, {"name": "20070419 [waraxe-2007-SA#049] - Multiple vulnerabilities in Phorum 5.1.20", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/466286/100/0/threaded"}, {"name": "2617", "tags": ["third-party-advisory", "x_refsource_SREASON"], "url": "http://securityreason.com/securityalert/2617"}, {"name": "23616", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/23616"}, {"name": "35057", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/35057"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2007-2248", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Multiple cross-site scripting (XSS) vulnerabilities in admin.php in Phorum before 5.1.22 allow remote attackers to inject arbitrary web script or HTML via the (1) group_id parameter in the groups module or (2) the smiley_id parameter in the smileys modsettings module."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://www.waraxe.us/advisory-49.html", "refsource": "MISC", "url": "http://www.waraxe.us/advisory-49.html"}, {"name": "http://www.phorum.org/story.php?76", "refsource": "CONFIRM", "url": "http://www.phorum.org/story.php?76"}, {"name": "1017936", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id?1017936"}, {"name": "24932", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/24932"}, {"name": "35058", "refsource": "OSVDB", "url": "http://osvdb.org/35058"}, {"name": "20070419 [waraxe-2007-SA#049] - Multiple vulnerabilities in Phorum 5.1.20", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/466286/100/0/threaded"}, {"name": "2617", "refsource": "SREASON", "url": "http://securityreason.com/securityalert/2617"}, {"name": "23616", "refsource": "BID", "url": "http://www.securityfocus.com/bid/23616"}, {"name": "35057", "refsource": "OSVDB", "url": "http://osvdb.org/35057"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T13:33:28.260Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.waraxe.us/advisory-49.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.phorum.org/story.php?76"}, {"name": "1017936", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id?1017936"}, {"name": "24932", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/24932"}, {"name": "35058", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/35058"}, {"name": "20070419 [waraxe-2007-SA#049] - Multiple vulnerabilities in Phorum 5.1.20", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/466286/100/0/threaded"}, {"name": "2617", "tags": ["third-party-advisory", "x_refsource_SREASON", "x_transferred"], "url": "http://securityreason.com/securityalert/2617"}, {"name": "23616", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/23616"}, {"name": "35057", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/35057"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2007-2248", "datePublished": "2007-04-25T16:00:00", "dateReserved": "2007-04-25T00:00:00", "dateUpdated": "2024-08-07T13:33:28.260Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:phorum:phorum:*:*:*:*:*:*:*:*", "matchCriteriaId": "195CE92F-6EC7-4E93-8C05-24AFC740253F", "versionEndIncluding": "5.1.21", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in admin.php in Phorum before 5.1.22 allow remote attackers to inject arbitrary web script or HTML via the (1) group_id parameter in the groups module or (2) the smiley_id parameter in the smileys modsettings module."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en admin.php de Phorum anterior a 5.1.22 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n mediante el (1) par\u00e1metro group_id en el m\u00f3dulo groups o el (2) par\u00e1metro smiley_id en el m\u00f3dulo smileys modsettings."}], "evaluatorSolution": "This vulnerability is addressed in the following product release:\r\nPhorum, Phorum, 5.1.22", "id": "CVE-2007-2248", "lastModified": "2024-11-21T00:30:17.930", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2007-04-25T16:19:00.000", "references": [{"source": "cve@mitre.org", "url": "http://osvdb.org/35057"}, {"source": "cve@mitre.org", "url": "http://osvdb.org/35058"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "http://secunia.com/advisories/24932"}, {"source": "cve@mitre.org", "url": "http://securityreason.com/securityalert/2617"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "http://www.phorum.org/story.php?76"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/466286/100/0/threaded"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Patch"], "url": "http://www.securityfocus.com/bid/23616"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "http://www.securitytracker.com/id?1017936"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "http://www.waraxe.us/advisory-49.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/35057"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/35058"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "http://secunia.com/advisories/24932"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securityreason.com/securityalert/2617"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "http://www.phorum.org/story.php?76"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/466286/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Patch"], "url": "http://www.securityfocus.com/bid/23616"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "http://www.securitytracker.com/id?1017936"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "http://www.waraxe.us/advisory-49.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}