National Cyber Awareness System

Vulnerability Summary for CVE-2011-3371

Overview

Multiple cross-site scripting (XSS) vulnerabilities in include/functions.php in PunBB before 1.3.6 allow remote attackers to inject arbitrary web script or HTML via the (1) id, (2) form_sent, (3) csrf_token, (4) req_confirm, or (5) delete parameter to delete.php, the (6) id, (7) form_sent, (8) csrf_token, (9) req_message, or (10) submit parameter to edit.php, the (11) action, (12) form_sent, (13) csrf_token, (14) req_email, or (15) request_pass parameter to login.php, the (16) email, (17) form_sent, (18) redirect_url, (19) csrf_token, (20) req_subject, (21) req_message, or (22) submit parameter to misc.php, the (23) action, (24) id, (25) form_sent, (26) csrf_token, (27) req_old_password, (28) req_new_password1, (29) req_new_password2, or (30) update parameter to profile.php, or the (31) action, (32) form_sent, (33) csrf_token, (34) req_username, (35) req_password1, (36) req_password2, (37) req_email1, (38) timezone, or (39) register parameter to register.php.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: https://github.com/punbb/punbb/commit/dd50a50a2760f10bd2d09814e30af4b36052ca6d

Type: Patch Information

Hyperlink:https://github.com/punbb/punbb/commit/dd50a50a2760f10bd2d09814e30af4b36052ca6d

External Source: CONFIRM

Name: https://github.com/downloads/punbb/punbb/punbb-1.3.6.zip

Type: Patch Information

Hyperlink:https://github.com/downloads/punbb/punbb/punbb-1.3.6.zip

External Source: MLIST

Name: [oss-security] 20110922 Re: CVE request: PunBB multiple XSS issues

Type: Patch Information

Hyperlink:http://www.openwall.com/lists/oss-security/2011/09/22/3

External Source: MLIST

Name: [oss-security] 20110918 CVE request: PunBB multiple XSS issues

Type: Patch Information

Hyperlink:http://www.openwall.com/lists/oss-security/2011/09/18/1

External Source: CONFIRM

Name: http://punbb.informer.com/forums/topic/24430/punbb-136/

Type: Patch Information

Hyperlink:http://punbb.informer.com/forums/topic/24430/punbb-136/

External Source: CONFIRM

Name: http://punbb.informer.com/forums/topic/24427/multiple-xss-vulnerabilities/

Type: Patch Information

Hyperlink:http://punbb.informer.com/forums/topic/24427/multiple-xss-vulnerabilities/

External Source: SECTRACK

Name: 1026073

Hyperlink:http://securitytracker.com/id?1026073

External Source: FULLDISC

Name: 20110922 Re: PunBB PHP Forum - Multiple XSS

Hyperlink:http://archives.neohapsis.com/archives/fulldisclosure/2011-09/0272.html

External Source: FULLDISC

Name: 20110918 Re: PunBB PHP Forum - Multiple XSS

Hyperlink:http://archives.neohapsis.com/archives/fulldisclosure/2011-09/0210.html

External Source: FULLDISC

Name: 20110916 PunBB PHP Forum - Multiple XSS

Hyperlink:http://archives.neohapsis.com/archives/fulldisclosure/2011-09/0193.html