CVE Vulnerability

CVE-2007-0437

Multiple cross-site scripting (XSS) vulnerabilities in the sample Cache' Server Page (CSP) scripts in InterSystems Cache' allow remote attackers to inject arbitrary web script or HTML via (1) the TO parameter to loop.csp, (2) the VALUE parameter to cookie.csp, and (3) the PAGE parameter to showsource.csp in csp/samples/; and allow remote authenticated users to inject arbitrary web script or HTML via (4) the ERROR parameter to csp/samples/xmlclasseserror.csp, and unspecified vectors in (5) object.csp and (6) lotteryhistory.csp in csp/samples/.

3.5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 6.8 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

References
Link Resource
http://www.cpni.gov.uk/Products/alerts/2928.aspx
http://www.mwrinfosecurity.com/advisories/mwri_cache-sample-files-xss-advisory_2007-04-04.pdf
http://www.mwrinfosecurity.com/news/1658.html
Configurations

Configuration 1

cpe:2.3:a:intersystems:cache_database:*:*:*:*:*:*:*:*
Information

Published : 2007-08-20 06:17

Updated : 2008-09-05 09:17

NVD link : CVE-2007-0437

Mitre link : CVE-2007-0437

Products Affected
No products.
CWE
NVD-CWE-Other