CVE-2006-1748 - Cross-site scripting (XSS) vulnerability in XMB Forum 1.9.5 allows remote attackers to inject arbitr

CVE-2006-1748

Summary

Cross-site scripting (XSS) vulnerability in XMB Forum 1.9.5 allows remote attackers to inject arbitrary web script or HTML by uploading a Flash (.SWF) video that contains a getURL function call, which causes the video to be rendered without disabling ActionScript.

References

Vulnerable Configurations

cpe:2.3:a:xmb_software:xmb_forum:1.9.5:*:*:*:*:*:*:*
cpe:2.3:a:xmb_software:xmb_forum:1.9.5:*:*:*:*:*:*:*

CVSS

Base:	2.6 (as of 29-04-2021 - 15:15)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	HIGH	NONE

Impact

Confidentiality	Integrity	Availability
NONE	PARTIAL	NONE

cvss-vector via4

AV:N/AC:H/Au:N/C:N/I:P/A:N

refmap via4

bid	17445
bugtraq	20060409 XMB Forum 1.9.5-Final XSS
xf	xmb-swf-geturl-xss(25737)

statements via4

contributor	Robert Chapin
lastmodified	2020-09-09
organization	XMB
statement	As noted in https://docs.xmbforum2.com/index.php?title=Security_Issue_History XMB version 1.9.10 or later must be installed to prevent attacks described by this CVE. All earlier versions of XMB are vulnerable until upgraded. Upgrades are available at https://www.xmbforum2.com/

Last major update

29-04-2021 - 15:15

Published

12-04-2006 - 22:02

Last modified

29-04-2021 - 15:15