CVE-2010-4513 - Vulnerability Details - OpenCVE

Multiple cross-site scripting (XSS) vulnerabilities in Zimplit CMS 3.0, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) file parameter in a load action to zimplit.php and (2) client parameter to English_manual_version_2.php.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Zimplit	Zimplit Cms

Configuration 1 [-]

cpe:2.3:a:zimplit:zimplit_cms:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://marc.info/?l=bugtraq&m=129182251500541&w=2
http://packetstormsecurity.org/files/view/96466/zimplit-xss.txt
http://secunia.com/advisories/41629
http://www.htbridge.ch/advisory/xss_vulnerability_in_zimplit_cms.html
http://www.htbridge.ch/advisory/xss_vulnerability_in_zimplit_cms_1.html
http://www.securityfocus.com/archive/1/515078/100/0/threaded
http://www.securityfocus.com/bid/45252

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2010-12-09T20:00:00

Updated: 2024-08-07T03:51:17.184Z

Reserved: 2010-12-09T00:00:00

Link: CVE-2010-4513

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2010-12-09T21:00:01.350

Modified: 2025-04-11T00:51:21.963

Link: CVE-2010-4513

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2010-12-06T00:00:00", "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in Zimplit CMS 3.0, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) file parameter in a load action to zimplit.php and (2) client parameter to English_manual_version_2.php."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-10T18:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_MISC"], "url": "http://www.htbridge.ch/advisory/xss_vulnerability_in_zimplit_cms_1.html"}, {"tags": ["x_refsource_MISC"], "url": "http://www.htbridge.ch/advisory/xss_vulnerability_in_zimplit_cms.html"}, {"name": "45252", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/45252"}, {"tags": ["x_refsource_MISC"], "url": "http://packetstormsecurity.org/files/view/96466/zimplit-xss.txt"}, {"name": "20101207 XSS vulnerability in Zimplit CMS", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/515078/100/0/threaded"}, {"name": "20101207 XSS vulnerability in Zimplit CMS", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://marc.info/?l=bugtraq&m=129182251500541&w=2"}, {"name": "41629", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/41629"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2010-4513", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Multiple cross-site scripting (XSS) vulnerabilities in Zimplit CMS 3.0, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) file parameter in a load action to zimplit.php and (2) client parameter to English_manual_version_2.php."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://www.htbridge.ch/advisory/xss_vulnerability_in_zimplit_cms_1.html", "refsource": "MISC", "url": "http://www.htbridge.ch/advisory/xss_vulnerability_in_zimplit_cms_1.html"}, {"name": "http://www.htbridge.ch/advisory/xss_vulnerability_in_zimplit_cms.html", "refsource": "MISC", "url": "http://www.htbridge.ch/advisory/xss_vulnerability_in_zimplit_cms.html"}, {"name": "45252", "refsource": "BID", "url": "http://www.securityfocus.com/bid/45252"}, {"name": "http://packetstormsecurity.org/files/view/96466/zimplit-xss.txt", "refsource": "MISC", "url": "http://packetstormsecurity.org/files/view/96466/zimplit-xss.txt"}, {"name": "20101207 XSS vulnerability in Zimplit CMS", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/515078/100/0/threaded"}, {"name": "20101207 XSS vulnerability in Zimplit CMS", "refsource": "BUGTRAQ", "url": "http://marc.info/?l=bugtraq&m=129182251500541&w=2"}, {"name": "41629", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/41629"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T03:51:17.184Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.htbridge.ch/advisory/xss_vulnerability_in_zimplit_cms_1.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.htbridge.ch/advisory/xss_vulnerability_in_zimplit_cms.html"}, {"name": "45252", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/45252"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://packetstormsecurity.org/files/view/96466/zimplit-xss.txt"}, {"name": "20101207 XSS vulnerability in Zimplit CMS", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/515078/100/0/threaded"}, {"name": "20101207 XSS vulnerability in Zimplit CMS", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://marc.info/?l=bugtraq&m=129182251500541&w=2"}, {"name": "41629", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/41629"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2010-4513", "datePublished": "2010-12-09T20:00:00", "dateReserved": "2010-12-09T00:00:00", "dateUpdated": "2024-08-07T03:51:17.184Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:zimplit:zimplit_cms:*:*:*:*:*:*:*:*", "matchCriteriaId": "84D90A52-A45F-4D5B-989C-546950F214AF", "versionEndIncluding": "3.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in Zimplit CMS 3.0, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the (1) file parameter in a load action to zimplit.php and (2) client parameter to English_manual_version_2.php."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en Zimplit CMS 3.0, y posiblemente versiones anteriores, permiten a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n a trav\u00e9s del par\u00e1metro (1) \"file\" en una acci\u00f3n \"load\" para zimplit.php y (2) el par\u00e1metro \"client\" para English_manual_version_2.php."}], "id": "CVE-2010-4513", "lastModified": "2025-04-11T00:51:21.963", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}]}, "published": "2010-12-09T21:00:01.350", "references": [{"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://marc.info/?l=bugtraq&m=129182251500541&w=2"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://packetstormsecurity.org/files/view/96466/zimplit-xss.txt"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/41629"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://www.htbridge.ch/advisory/xss_vulnerability_in_zimplit_cms.html"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://www.htbridge.ch/advisory/xss_vulnerability_in_zimplit_cms_1.html"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/515078/100/0/threaded"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/45252"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://marc.info/?l=bugtraq&m=129182251500541&w=2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://packetstormsecurity.org/files/view/96466/zimplit-xss.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/41629"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://www.htbridge.ch/advisory/xss_vulnerability_in_zimplit_cms.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://www.htbridge.ch/advisory/xss_vulnerability_in_zimplit_cms_1.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/515078/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/45252"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}