Detections
Analytics
GForge <= 4.5 Multiple Script XSS
medium Nessus Plugin ID 19314
Language:
Synopsis
The remote web server contains a PHP script that is affected by multiple cross-site scripting vulnerabilities.Description
The remote host is running GForge, an open source software development collaborative toolset using PHP and PostgreSQL.The installed version of GForge on the remote host fails to properly sanitize user-supplied input to several parameters / scripts before using it in dynamically-generated pages. An attacker can exploit these flaws to launch cross-site scripting attacks against the affected application.
Solution
Unknown at this time.See Also
https://www.securityfocus.com/archive/1/406723/30/0/threaded
Plugin Details
Severity: Medium
ID: 19314
File Name: gforge_45.nasl
Version: 1.29
Type: remote
Family: CGI abuses : XSS
Published: 7/29/2005
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.8
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
Vulnerability Information
CPE: cpe:/a:gforge:gforge
Required KB Items: www/gforge
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Ease: No exploit is required
Vulnerability Publication Date: 7/28/2005
Reference Information
CVE: CVE-2005-2430
BID: 14405