Detections
Analytics
CuteNews show_archives.php archive Parameter XSS
medium Nessus Plugin ID 14318
Language:
Synopsis
The remote web server contains a PHP script that is affected by a cross-site scripting vulnerability.Description
According to its banner, the version of CuteNews on the remote host is affected by a cross-site scripting (XSS) vulnerability due to a failure to sanitize input to the 'archive' parameter of the show_archives.php script. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to execute arbitrary script code in a user's browser session.Solution
Upgrade to CuteNews v1.3.2 or later.See Also
https://secuniaresearch.flexerasoftware.com/advisories/12260/
Plugin Details
Severity: Medium
ID: 14318
File Name: cutenews_xss.nasl
Version: 1.29
Type: remote
Family: CGI abuses : XSS
Published: 8/20/2004
Updated: 1/19/2021
Supported Sensors: Nessus
Risk Information
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS v3
Risk Factor: Medium
Base Score: 4.7
Temporal Score: 4.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C
Vulnerability Information
Required KB Items: www/cutenews
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Available: true
Exploit Ease: No exploit is required
Vulnerability Publication Date: 8/16/2004
Reference Information
BID: 10948