3.5

CVE-2011-1129

Cross-site scripting (XSS) vulnerability in the EditNews function in ManageNews.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, might allow remote authenticated users to inject arbitrary web script or HTML via a save_items action.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Simplemachines ≫ Smf Version <= 1.1.12
Simplemachines ≫ Smf Version 1.0
Simplemachines ≫ Smf Version 1.0 Update beta4
Simplemachines ≫ Smf Version 1.0 Update beta4.1
Simplemachines ≫ Smf Version 1.0 Update beta5
Simplemachines ≫ Smf Version 1.0 Update beta6
Simplemachines ≫ Smf Version 1.0 Update rc1
Simplemachines ≫ Smf Version 1.0 Update rc2
Simplemachines ≫ Smf Version 1.0.1
Simplemachines ≫ Smf Version 1.0.2
Simplemachines ≫ Smf Version 1.0.3
Simplemachines ≫ Smf Version 1.0.4
Simplemachines ≫ Smf Version 1.0.5
Simplemachines ≫ Smf Version 1.0.6
Simplemachines ≫ Smf Version 1.0.7
Simplemachines ≫ Smf Version 1.0.8
Simplemachines ≫ Smf Version 1.0.9
Simplemachines ≫ Smf Version 1.0.10
Simplemachines ≫ Smf Version 1.0.12
Simplemachines ≫ Smf Version 1.0.13
Simplemachines ≫ Smf Version 1.0.14
Simplemachines ≫ Smf Version 1.0.15
Simplemachines ≫ Smf Version 1.0.16
Simplemachines ≫ Smf Version 1.0.17
Simplemachines ≫ Smf Version 1.0.18
Simplemachines ≫ Smf Version 1.0.19
Simplemachines ≫ Smf Version 1.0.20
Simplemachines ≫ Smf Version 1.0.21
Simplemachines ≫ Smf Version 1.1
Simplemachines ≫ Smf Version 1.1 Update beta1
Simplemachines ≫ Smf Version 1.1 Update beta2
Simplemachines ≫ Smf Version 1.1 Update beta3
Simplemachines ≫ Smf Version 1.1 Update beta4
Simplemachines ≫ Smf Version 1.1 Update rc1
Simplemachines ≫ Smf Version 1.1 Update rc2
Simplemachines ≫ Smf Version 1.1 Update rc3
Simplemachines ≫ Smf Version 1.1.1
Simplemachines ≫ Smf Version 1.1.2
Simplemachines ≫ Smf Version 1.1.3
Simplemachines ≫ Smf Version 1.1.4
Simplemachines ≫ Smf Version 1.1.5
Simplemachines ≫ Smf Version 1.1.6
Simplemachines ≫ Smf Version 1.1.7
Simplemachines ≫ Smf Version 1.1.8
Simplemachines ≫ Smf Version 1.1.9
Simplemachines ≫ Smf Version 1.1.10
Simplemachines ≫ Smf Version 1.1.11
Simplemachines ≫ Smf Version 2.0 Update beta1
Simplemachines ≫ Smf Version 2.0 Update beta2
Simplemachines ≫ Smf Version 2.0 Update beta2.1
Simplemachines ≫ Smf Version 2.0 Update beta3
Simplemachines ≫ Smf Version 2.0 Update beta3.1
Simplemachines ≫ Smf Version 2.0 Update beta4
Simplemachines ≫ Smf Version 2.0 Update rc1
Simplemachines ≫ Smf Version 2.0 Update rc2
Simplemachines ≫ Smf Version 2.0 Update rc3
Simplemachines ≫ Smf Version 2.0 Update rc4
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1% 0.584
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 3.5 6.8 2.9
AV:N/AC:M/Au:S/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip
Patch
http://www.openwall.com/lists/oss-security/2011/02/22/17
Patch
http://www.openwall.com/lists/oss-security/2011/03/02/4
Patch
http://www.simplemachines.org/community/index.php?topic=421547.0
Patch