CVE-2007-3182 - Multiple cross-site scripting (XSS) vulnerabilities in Calendarix 0.7.20070307, when register_global

CVE-2007-3182

Summary

Multiple cross-site scripting (XSS) vulnerabilities in Calendarix 0.7.20070307, when register_globals is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) year and (2) month parameters to calendar.php, and the (3) leftfooter parameter to cal_footer.inc.php. NOTE: the ycyear parameter to yearcal.php is already covered by CVE-2006-1835.

References

Vulnerable Configurations

cpe:2.3:a:vincent_hor:calendarix:0.7.2007-03-07:*:*:*:*:*:*:*
cpe:2.3:a:vincent_hor:calendarix:0.7.2007-03-07:*:*:*:*:*:*:*

CVSS

Base:	4.3 (as of 16-10-2018 - 16:47)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
NONE	PARTIAL	NONE

cvss-vector via4

AV:N/AC:M/Au:N/C:N/I:P/A:N

refmap via4

bid	24626
bugtraq	20070625 Calendarix version 0.7. 20070307 Multiple XSS Attacks
misc	http://www.netvigilance.com/advisory0037
osvdb	35372 35695 35696
secunia	25795
sreason	2838
vupen	ADV-2007-2324
xf	calendarix-multiple-xss(35045)

Last major update

16-10-2018 - 16:47

Published

26-06-2007 - 17:30

Last modified

16-10-2018 - 16:47