製品・ソフトウェアに関する情報

JVN脆弱性詳細

Easy PHP Calendar の index.php および datePicker.php におけるクロスサイトスクリプティングの脆弱性

Title	Easy PHP Calendar の index.php および datePicker.php におけるクロスサイトスクリプティングの脆弱性
Summary	Easy PHP Calendar の (1) index.php および (2) datePicker.php には、クロスサイトスクリプティングの脆弱性が存在します。
Possible impacts	第三者により、任意の Web スクリプトまたは HTML を挿入される可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	April 12, 2013, midnight
Registration Date	July 23, 2013, 2:38 p.m.
Last Update	July 23, 2013, 2:38 p.m.

Affected System

NashTech

Easy PHP Calendar 6.x

Easy PHP Calendar 7.0.13 未満の 7.x

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2013-1955	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1955
National Vulnerability Database (NVD)
2	CVE-2013-1955	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-1955

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-79	https://jvndb.jvn.jp/ja/cwe/CWE-79.html

ベンダー情報

No	Name	URL
nashtech
1	Change Log	http://docs7.easyphpcalendar.com/source/ChangeLog/changeLog.htm
2	Top Page	http://www.easyphpcalendar.com/
3	Two problems - Easy PHP Calendar	http://www.easyphpcalendar.com/forums/showthread.php?p=4555

その他

No	Name	URL
関連文書
1	Re: CVE for XSS in EasyPHPCalender script	http://www.openwall.com/lists/oss-security/2013/04/16/6

Change Log

No	Changed Details	Date of change
0	[2013年07月23日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2013-1955

Summary	Multiple cross-site scripting (XSS) vulnerabilities in (1) index.php and (2) datePicker.php in Easy PHP Calendar 6.x and 7.x before 7.0.13 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Publication Date	July 20, 2013, 12:37 p.m.
Registration Date	Jan. 26, 2021, 3:37 p.m.
Last Update	Nov. 21, 2024, 10:50 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:nashtech:easy_php_calendar:7.0.01:::::::*
cpe:2.3:a:nashtech:easy_php_calendar:7.0.00:::::::*
cpe:2.3:a:nashtech:easy_php_calendar:7.0.11:::::::*
cpe:2.3:a:nashtech:easy_php_calendar:7.0.06:::::::*
cpe:2.3:a:nashtech:easy_php_calendar:7.0.03:::::::*
cpe:2.3:a:nashtech:easy_php_calendar:7.0.09:::::::*
cpe:2.3:a:nashtech:easy_php_calendar:6.0:::::::*
cpe:2.3:a:nashtech:easy_php_calendar:7.0.08:::::::*
cpe:2.3:a:nashtech:easy_php_calendar:7.0.05:::::::*
cpe:2.3:a:nashtech:easy_php_calendar:7.0.10:::::::*
cpe:2.3:a:nashtech:easy_php_calendar::::::::		7.0.12
cpe:2.3:a:nashtech:easy_php_calendar:7.0.04:::::::*
cpe:2.3:a:nashtech:easy_php_calendar:7.0.07:::::::*
cpe:2.3:a:nashtech:easy_php_calendar:7.0.02:::::::*

Related information, measures and tools

No	URL	タグ
1	http://docs7.easyphpcalendar.com/source/ChangeLog/changeLog.htm	Vendor Advisory
2	http://docs7.easyphpcalendar.com/source/ChangeLog/changeLog.htm	Vendor Advisory
3	http://www.easyphpcalendar.com/forums/showthread.php?p=4555
4	http://www.easyphpcalendar.com/forums/showthread.php?p=4555
5	http://www.openwall.com/lists/oss-security/2013/04/16/6
6	http://www.openwall.com/lists/oss-security/2013/04/16/6

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-79	クロスサイト・スクリプティング（XSS）	https://cwe.mitre.org/data/definitions/79.html

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:nashtech:easy_php_calendar:7.0.01:::::::*
cpe:2.3:a:nashtech:easy_php_calendar:7.0.00:::::::*
cpe:2.3:a:nashtech:easy_php_calendar:7.0.11:::::::*
cpe:2.3:a:nashtech:easy_php_calendar:7.0.06:::::::*
cpe:2.3:a:nashtech:easy_php_calendar:7.0.03:::::::*
cpe:2.3:a:nashtech:easy_php_calendar:7.0.09:::::::*
cpe:2.3:a:nashtech:easy_php_calendar:6.0:::::::*
cpe:2.3:a:nashtech:easy_php_calendar:7.0.08:::::::*
cpe:2.3:a:nashtech:easy_php_calendar:7.0.05:::::::*
cpe:2.3:a:nashtech:easy_php_calendar:7.0.10:::::::*
cpe:2.3:a:nashtech:easy_php_calendar::::::::		7.0.12
cpe:2.3:a:nashtech:easy_php_calendar:7.0.04:::::::*
cpe:2.3:a:nashtech:easy_php_calendar:7.0.07:::::::*
cpe:2.3:a:nashtech:easy_php_calendar:7.0.02:::::::*