CVE-2004-1822

Severity

43%

Complexity

86%

Confidentiality

48%

Multiple cross-site scripting (XSS) vulnerabilities in Phorum 3.1 through 5.0.3 beta allow remote attackers to inject arbitrary web script or HTML via the (1) HTTP_REFERER parameter to login.php, (2) HTTP_REFERER parameter to register.php, or (3) target parameter to profile.php.

CVSS 2.0 Base Score 4.3. CVSS Attack Vector: network. CVSS Attack Complexity: medium. CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N).

Overview

Type

Phorum

First reported 20 years ago

2004-03-15 05:00:00

Last updated 7 years ago

2017-07-11 01:31:00

Affected Software

Phorum 3.1

3.1

Phorum 3.1.1

3.1.1

Phorum 3.1.2

3.1.2

Phorum 3.2

3.2

Phorum 3.2.2

3.2.2

Phorum 3.2.3

3.2.3

Phorum 3.2.4

3.2.4

Phorum 3.2.5

3.2.5

Phorum 3.2.6

3.2.6

Phorum 3.2.7

3.2.7

Phorum 3.2.8

3.2.8

Phorum 3.3.1

3.3.1

Phorum 3.3.2

3.3.2

Phorum 3.4

3.4

Phorum 3.4.1

3.4.1

Phorum 3.4.2

3.4.2

Phorum 3.4.3

3.4.3

Phorum 3.4.4

3.4.4

Phorum 3.4.5

3.4.5

Phorum 3.4.6

3.4.6

References

20040315 Phorum 5.0.3 Beta && Earlier XSS Issues

http://phorum.org/changelog.txt

Vendor Advisory

11157

Patch, Vendor Advisory

1009433

4333

4334

4335

9882