vulnwire
4.3med

CVE-2005-44541 exploit

Validate-before-filter vulnerability in cleanhtml.pl 1.129 in LiveJournal CVS before Dec 7 2005, when the cleancss option is enabled, allow…

Published 20 y ago · modified 4 mo ago · JSON

CVSS
4.3
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.1%
percentile 82%
Public exploits
1
Exploit-DB

Validate-before-filter vulnerability in cleanhtml.pl 1.129 in LiveJournal CVS before Dec 7 2005, when the cleancss option is enabled, allows remote attackers to conduct cross-site scripting (XSS) attacks via a "\" (backslash) within a "javascript" scheme in a style property (such as "javas\cript"), which bypasses the "javascript" check before the "\" is stripped and then rendered in web browsers that allow scripting in style sheets.

Exploit prediction (EPSS)

2.12% probability of exploitation in the next 30 days, higher than 82% of all scored CVEs.

Exploits and detections

  • EDB-26917 LiveJournal - Cleanhtml.pl HTML Injection · webapps · 2005-12-20

CVSS scores

Assigned byVersionScoreVector
NVD2.04.3AV:N/AC:M/Au:N/C:N/I:P/A:N

References

  • secunia.com /advisories/18157 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • osvdb.org /21896 · vdb-entry, x_refsource_OSVDB, x_transferred
  • marc.info /?l=full-disclosure&m=113504421421972&w=2 · mailing-list, x_refsource_FULLDISC, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/23839 · vdb-entry, x_refsource_XF, x_transferred
  • cvs.livejournal.org /browse.cgi/livejournal/cgi-bin/cleanhtml.pl · x_refsource_CONFIRM, x_transferred
  • archives.neohapsis.com /archives/fulldisclosure/2005-12/1000.html · mailing-list, x_refsource_FULLDISC, x_transferred
  • securityfocus.com /bid/15990 · vdb-entry, x_refsource_BID, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.