CVE-2005-2204 Cross-site scripting (XSS) vulnerability in Computer Associates (CA) eTrust SiteMinder 5.5, when the "CSSChecking" parameter is set to "NO," allows remote attackers to inject arbitrary web script or H...
MediumCVSS 4.3
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in Computer Associates (CA) eTrust SiteMinder 5.5, when the "CSSChecking" parameter is set to "NO," allows remote attackers to inject arbitrary web script or HTML via the (1) PASSWORD or (2) BUFFER parameters to smpwservicescgi.exe, (3) the TARGET parameter to login.fcc, and possibly other vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| broadcom etrust siteminder | = 5.5 | No fix listed |
References
- 20050708 SiteMinder Multiple Vulnerabilities mailing-list
- 20050711 Re: SiteMinder Multiple Vulnerabilities mailing-list
- 15956 third-party-advisory
- 1014433 exploit vdb-entry
- 17809 vdb-entry
- 17810 vdb-entry
- ADV-2005-1040 vdb-entry
- ca-siteminder-smpwservicescgi-xss(21305) vdb-entry