YaBB Shadow BBCode Tag XSS

Medium Nessus Network Monitor Plugin ID 2439

Synopsis

The remote host is vulnerable to a script injection attack

Description

The remote host is using the YaBB web forum software.
According to its version number, the remote version of this software is vulnerable to JavaScript injection issues using shadow or glow tags. This may allow an attacker to inject hostile JavaScript into the forum system to steal cookie credentials or misrepresent site content. When the form is submitted the malicious JavaScript will be incorporated into dynamically generated content.

Solution

Upgrade to YaBB 1 Gold SP 1.4 or higher.

See Also

http://www.yabbforum.com/archives.php?currentpage=7

Plugin Details

Severity: Medium

ID: 2439

File Name: 2439.prm

Family: CGI

Published: 2004/11/30

Modified: 2016/01/21

Dependencies: 1442

Nessus ID: 15859

Risk Information

Risk Factor: Medium

CVSSv2

Base Score: 4.3

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Temporal Vector: CVSS2#E:H/RL:OF/RC:C

CVSSv3

Base Score: 5.3

Temporal Score: 5.1

Vector: CVSS3#AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: CVSS3#E:H/RL:O/RC:X

Reference Information

BID: 11764

OSVDB: 12145