vulnwire
3.5low

CVE-2007-4523

Multiple cross-site scripting (XSS) vulnerabilities in Ripe Website Manager 0.8.9 and earlier allow remote authenticated users to inject ar…

Published 19 y ago · modified 4 mo ago · JSON

CVSS
3.5
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.1%
percentile 67%
Public exploits
0
none known

Multiple cross-site scripting (XSS) vulnerabilities in Ripe Website Manager 0.8.9 and earlier allow remote authenticated users to inject arbitrary web script or HTML via one or more of the following vectors: the (1) id parameter to (a) pages/delete_page.php, (b) navigation/delete_menu.php, and (c) navigation/delete_item.php in admin/; the (2) menu_id, (3) name, (3) page_id, and (4) url parameters in (d) admin/navigation/do_new_item.php; the (5) new_menuname parameter in (e) admin/navigation/do_new_nav.php; and (6) area1, name, and url parameters to (f) admin/pages/do_new_page.php, probably involving the Title or textarea field as reachable through admin/pages/new_page.php. NOTE: the original disclosure does not precisely state which vectors are associated with SQL injection versus XSS.

Exploit prediction (EPSS)

1.15% probability of exploitation in the next 30 days, higher than 67% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.03.5AV:N/AC:M/Au:S/C:N/I:P/A:N

References

  • osvdb.org /38444 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /38448 · vdb-entry, x_refsource_OSVDB, x_transferred
  • securityfocus.com /archive/1/477320/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • osvdb.org /38446 · vdb-entry, x_refsource_OSVDB, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/36179 · vdb-entry, x_refsource_XF, x_transferred
  • securityfocus.com /bid/25406 · vdb-entry, x_refsource_BID, x_transferred
  • securityreason.com /securityalert/3058 · third-party-advisory, x_refsource_SREASON, x_transferred
  • osvdb.org /38449 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /38447 · vdb-entry, x_refsource_OSVDB, x_transferred
  • osvdb.org /38445 · vdb-entry, x_refsource_OSVDB, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.