NVD Vulnerability Detail

CVE-2012-0984

Summary	Multiple cross-site scripting (XSS) vulnerabilities in XOOPS before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via the (1) to_userid parameter to modules/pm/pmlite.php or the (2) current_file, (3) imgcat_id, or (4) target parameter to class/xoopseditor/tinymce/tinymce/jscripts/tiny_mce/plugins/xoopsimagemanager/xoopsimagebrowser.php.
Publication Date	Sept. 11, 2014, 11:16 p.m.
Registration Date	Jan. 28, 2021, 2:54 p.m.
Last Update	Nov. 21, 2024, 10:36 a.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://archives.neohapsis.com/archives/bugtraq/2012-04/0128.html	Exploit
2	http://osvdb.org/81212
3	http://osvdb.org/81213
4	http://packetstormsecurity.org/files/111958/XOOPS-2.5.4-Cross-Site-Scripting.html	Exploit
5	http://secunia.com/advisories/48887
6	http://www.exploit-db.com/exploits/18753	Exploit
7	http://www.securityfocus.com/bid/53143
8	http://xoops.org/modules/news/article.php?storyid=6284	Patch Vendor Advisory
9	https://exchange.xforce.ibmcloud.com/vulnerabilities/75024
10	https://www.htbridge.com/advisory/multiple_vulnerabilities_in_xoops.html	Exploit
11	http://archives.neohapsis.com/archives/bugtraq/2012-04/0128.html	Exploit
12	https://www.htbridge.com/advisory/multiple_vulnerabilities_in_xoops.html	Exploit
13	https://exchange.xforce.ibmcloud.com/vulnerabilities/75024
14	http://xoops.org/modules/news/article.php?storyid=6284	Patch Vendor Advisory
15	http://www.securityfocus.com/bid/53143
16	http://www.exploit-db.com/exploits/18753	Exploit
17	http://secunia.com/advisories/48887
18	http://packetstormsecurity.org/files/111958/XOOPS-2.5.4-Cross-Site-Scripting.html	Exploit
19	http://osvdb.org/81213
20	http://osvdb.org/81212

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-79	クロスサイト・スクリプティング（XSS）	https://cwe.mitre.org/data/definitions/79.html

JVN Vulnerability Information

XOOPS におけるクロスサイトスクリプティングの脆弱性

Title	XOOPS におけるクロスサイトスクリプティングの脆弱性
Summary	XOOPS には、クロスサイトスクリプティングの脆弱性が存在します。
Possible impacts	第三者により、以下のパラメータを介して、任意の Web スクリプトまたは HTML を挿入される可能性があります。 (1) modules/pm/pmlite.php の_userid パラメータ (2) class/xoopseditor/tinymce/tinymce/jscripts/tiny_mce/plugins/xoopsimagemanager/xoopsimagebrowser.php の current_file パラメータ (3) class/xoopseditor/tinymce/tinymce/jscripts/tiny_mce/plugins/xoopsimagemanager/xoopsimagebrowser.php の imgcat_id パラメータ (4) class/xoopseditor/tinymce/tinymce/jscripts/tiny_mce/plugins/xoopsimagemanager/xoopsimagebrowser.php の target パラメータ
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	April 16, 2012, midnight
Registration Date	Sept. 12, 2014, 1:50 p.m.
Last Update	Sept. 12, 2014, 1:50 p.m.

Affected System

XOOPS

XOOPS 2.5.5 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2012-0984	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0984
National Vulnerability Database (NVD)
2	CVE-2012-0984	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-0984

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-79	https://jvndb.jvn.jp/ja/cwe/CWE-79.html

ベンダー情報

No	Name	URL
XOOPS
1	XOOPS 2.5.5 Final Released	http://xoops.org/modules/news/article.php?storyid=6284

Change Log

No	Changed Details	Date of change
0	[2014年09月12日] 掲載	Feb. 17, 2018, 10:37 a.m.