CVE-2007-1873 - Vulnerability Details - OpenCVE

Cross-site scripting (XSS) vulnerability in Mephisto 0.7.3 allows remote attackers to inject arbitrary web script or HTML via the q parameter to the search script.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Mephisto	Mephisto

Configuration 1 [-]

cpe:2.3:a:mephisto:mephisto:0.7.3:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://int21.de/cve/CVE-2007-1873-mephisto.txt
http://osvdb.org/34911
http://secunia.com/advisories/24870
http://www.securityfocus.com/archive/1/465484/100/0/threaded
http://www.securityfocus.com/archive/1/465548/100/0/threaded
http://www.securityfocus.com/bid/23141
http://www.vupen.com/english/advisories/2007/1373
https://exchange.xforce.ibmcloud.com/vulnerabilities/33484
https://exchange.xforce.ibmcloud.com/vulnerabilities/33620

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2007-04-13T18:00:00

Updated: 2024-08-07T13:13:41.470Z

Reserved: 2007-04-05T00:00:00

Link: CVE-2007-1873

Vulnrichment

No data.

NVD

Status : Modified

Published: 2007-04-13T18:19:00.000

Modified: 2024-11-21T00:29:21.603

Link: CVE-2007-1873

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2007-04-11T00:00:00", "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in Mephisto 0.7.3 allows remote attackers to inject arbitrary web script or HTML via the q parameter to the search script."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-10-16T14:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "24870", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/24870"}, {"name": "20070411 Cross site scripting in mephisto 0.7.3", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/465484/100/0/threaded"}, {"name": "23141", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/23141"}, {"name": "34911", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/34911"}, {"name": "mephisto-search-xss(33620)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33620"}, {"name": "ADV-2007-1373", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2007/1373"}, {"name": "20070412 Re: Cross site scripting in mephisto 0.7.3", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://www.securityfocus.com/archive/1/465548/100/0/threaded"}, {"tags": ["x_refsource_MISC"], "url": "http://int21.de/cve/CVE-2007-1873-mephisto.txt"}, {"name": "mephisto-search-function-xss(33484)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33484"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2007-1873", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Cross-site scripting (XSS) vulnerability in Mephisto 0.7.3 allows remote attackers to inject arbitrary web script or HTML via the q parameter to the search script."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "24870", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/24870"}, {"name": "20070411 Cross site scripting in mephisto 0.7.3", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/465484/100/0/threaded"}, {"name": "23141", "refsource": "BID", "url": "http://www.securityfocus.com/bid/23141"}, {"name": "34911", "refsource": "OSVDB", "url": "http://osvdb.org/34911"}, {"name": "mephisto-search-xss(33620)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33620"}, {"name": "ADV-2007-1373", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2007/1373"}, {"name": "20070412 Re: Cross site scripting in mephisto 0.7.3", "refsource": "BUGTRAQ", "url": "http://www.securityfocus.com/archive/1/465548/100/0/threaded"}, {"name": "http://int21.de/cve/CVE-2007-1873-mephisto.txt", "refsource": "MISC", "url": "http://int21.de/cve/CVE-2007-1873-mephisto.txt"}, {"name": "mephisto-search-function-xss(33484)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33484"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T13:13:41.470Z"}, "title": "CVE Program Container", "references": [{"name": "24870", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/24870"}, {"name": "20070411 Cross site scripting in mephisto 0.7.3", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/465484/100/0/threaded"}, {"name": "23141", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/23141"}, {"name": "34911", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/34911"}, {"name": "mephisto-search-xss(33620)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33620"}, {"name": "ADV-2007-1373", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2007/1373"}, {"name": "20070412 Re: Cross site scripting in mephisto 0.7.3", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://www.securityfocus.com/archive/1/465548/100/0/threaded"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://int21.de/cve/CVE-2007-1873-mephisto.txt"}, {"name": "mephisto-search-function-xss(33484)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33484"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2007-1873", "datePublished": "2007-04-13T18:00:00", "dateReserved": "2007-04-05T00:00:00", "dateUpdated": "2024-08-07T13:13:41.470Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mephisto:mephisto:0.7.3:*:*:*:*:*:*:*", "matchCriteriaId": "950A628A-6EFF-4366-B858-A6A259358D66", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in Mephisto 0.7.3 allows remote attackers to inject arbitrary web script or HTML via the q parameter to the search script."}, {"lang": "es", "value": "Vulnerabilidad de XSS en Mephisto 0.7.3 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s del par\u00e1metro q para la secuencia de comandos de b\u00fasqueda."}], "id": "CVE-2007-1873", "lastModified": "2024-11-21T00:29:21.603", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2007-04-13T18:19:00.000", "references": [{"source": "cve@mitre.org", "url": "http://int21.de/cve/CVE-2007-1873-mephisto.txt"}, {"source": "cve@mitre.org", "url": "http://osvdb.org/34911"}, {"source": "cve@mitre.org", "url": "http://secunia.com/advisories/24870"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/465484/100/0/threaded"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/archive/1/465548/100/0/threaded"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/23141"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2007/1373"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33484"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33620"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://int21.de/cve/CVE-2007-1873-mephisto.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://osvdb.org/34911"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/24870"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/465484/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/archive/1/465548/100/0/threaded"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/23141"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2007/1373"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33484"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33620"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}