Vulnerability Details CVE-2002-1996
Cross-site scripting (XSS) vulnerability in PostNuke 0.71 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) name parameter in modules.php and (2) catid parameter in index.php.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.005
EPSS Ranking 65.2%
CVSS Severity
CVSS v2 Score 2.6
References
- http://archives.neohapsis.com/archives/bugtraq/2002-03/0288.html
- http://archives.neohapsis.com/archives/bugtraq/2002-03/0299.html
- http://sourceforge.net/tracker/index.php?func=detail&aid=524777&group_id=27927&atid=392228
- http://www.iss.net/security_center/static/8605.php
- http://www.securityfocus.com/bid/4350
- http://archives.neohapsis.com/archives/bugtraq/2002-03/0288.html
- http://archives.neohapsis.com/archives/bugtraq/2002-03/0299.html
- http://sourceforge.net/tracker/index.php?func=detail&aid=524777&group_id=27927&atid=392228
- http://www.iss.net/security_center/static/8605.php
- http://www.securityfocus.com/bid/4350
Products affected by CVE-2002-1996
-
cpe:2.3:a:postnuke_software_foundation:postnuke:0.62
-
cpe:2.3:a:postnuke_software_foundation:postnuke:0.63
-
cpe:2.3:a:postnuke_software_foundation:postnuke:0.64
-
cpe:2.3:a:postnuke_software_foundation:postnuke:0.7
-
cpe:2.3:a:postnuke_software_foundation:postnuke:0.70
-
cpe:2.3:a:postnuke_software_foundation:postnuke:0.703
-
cpe:2.3:a:postnuke_software_foundation:postnuke:0.71