helm_web_hosting_control_panel 跨站脚本漏洞

CVE编号

CVE-2006-5984

利用情况

暂无

补丁情况

N/A

披露时间

2006-11-21

漏洞描述

Multiple cross-site scripting (XSS) vulnerabilities in Helm Web Hosting Control Panel 3.2.10 allow remote authenticated users to inject arbitrary web script or HTML via the (1) txtCompanyName, (2) txtEmail, or (3) txtUserAccNum parameter to (a) users.asp, or the (4) setThemeColour parameter to (b) default.asp in the Reseller and Admin levels; or the (5) setThemeColour parameter to default.asp in the User level. NOTE: the txtDomainName parameter to domains.asp is covered by CVE-2006-1407, which suggests that this vector is fixed in 3.2.10 stable.

解决建议

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考链接
http://aria-security.net/advisory/helm.txt
http://secunia.com/advisories/22916
http://securityreason.com/securityalert/1884
http://securitytracker.com/id?1017240
http://www.securityfocus.com/archive/1/451737/100/0/threaded
http://www.securityfocus.com/archive/1/451848/100/200/threaded
http://www.vupen.com/english/advisories/2006/4557
https://exchange.xforce.ibmcloud.com/vulnerabilities/30309

受影响软件情况

#	类型	厂商	产品	版本	影响面
1
	运行在以下环境
	应用	webhost_automation	helm_web_hosting_control_panel	3.2.10	-

CVSS3评分 6.8

• 攻击路径 网络
• 攻击复杂度 N/A
• 权限要求 无
• 影响范围 N/A
• 用户交互 无
• 可用性 部分地
• 保密性 部分地
• 完整性 部分地

AV:N/AC:M/Au:N/C:P/I:P/A:P CWE-ID 漏洞类型 NVD-CWE-Other