CVE-2006-0800

CVSS V2 Low 2.6 CVSS V3 None
Description
Interpretation conflict in PostNuke 0.761 and earlier allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML tags with a trailing "<" character, which is interpreted as a ">" character by some web browsers but bypasses the blacklist protection in (1) the pnVarCleanFromInput function in pnAPI.php, (2) the pnSecureInput function in pnAntiCracker.php, and (3) the htmltext parameter in an edituser operation to user.php.
Overview
  • CVE ID
  • CVE-2006-0800
  • Assigner
  • cve@mitre.org
  • Vulnerability Status
  • Modified
  • Published Version
  • 2006-02-20T22:02:00
  • Last Modified Date
  • 2017-07-20T01:30:05
Weakness Enumerations
CWE URL
CWE-79 http://cwe.mitre.org/data/definitions/79.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:postnuke_software_foundation:postnuke:0.7:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postnuke_software_foundation:postnuke:0.62:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postnuke_software_foundation:postnuke:0.63:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postnuke_software_foundation:postnuke:0.64:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postnuke_software_foundation:postnuke:0.70:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postnuke_software_foundation:postnuke:0.71:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postnuke_software_foundation:postnuke:0.72:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postnuke_software_foundation:postnuke:0.73:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postnuke_software_foundation:postnuke:0.74:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postnuke_software_foundation:postnuke:0.75:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postnuke_software_foundation:postnuke:0.75_rc3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postnuke_software_foundation:postnuke:0.76_rc4:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postnuke_software_foundation:postnuke:0.76_rc4a:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postnuke_software_foundation:postnuke:0.76_rc4b:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postnuke_software_foundation:postnuke:0.703:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postnuke_software_foundation:postnuke:0.721:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postnuke_software_foundation:postnuke:0.726.3:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postnuke_software_foundation:postnuke:0.761:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:postnuke_software_foundation:postnuke:0.761a:*:*:*:*:*:*:* 1 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:H/Au:N/C:N/I:P/A:N
  • Access Vector
  • NETWORK
  • Access Compatibility
  • HIGH
  • Authentication
  • NONE
  • Confidentiality Impact
  • NONE
  • Integrity Impact
  • PARTIAL
  • Availability Impact
  • NONE
  • Base Score
  • 2.6
  • Severity
  • LOW
  • Exploitability Score
  • 4.9
  • Impact Score
  • 2.9
References
Reference URL Reference Tags
http://archives.neohapsis.com/archives/fulldisclosure/2006-02/0469.html
http://www.securityfocus.com/bid/16752 Exploit Patch
http://secunia.com/advisories/18937 Patch Vendor Advisory
http://news.postnuke.com/index.php?name=News&file=article&sid=2754 Patch
http://www.vupen.com/english/advisories/2006/0673 Vendor Advisory
http://securityreason.com/securityalert/454
https://exchange.xforce.ibmcloud.com/vulnerabilities/24823
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2006-0800
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0800
History
Created Old Value New Value Data Type Notes
2022-05-10 09:22:52 Added to TrackCVE