CVE-2008-3874 Cross-site scripting (XSS) vulnerability in account.php in Lussumo Vanilla 1.1.5-rc1, 1.1.4, and earlier allows remote authenticated users to inject arbitrary web script or HTML via the Value field (a...
LowCVSS 3.5
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in account.php in Lussumo Vanilla 1.1.5-rc1, 1.1.4, and earlier allows remote authenticated users to inject arbitrary web script or HTML via the Value field (aka Label ==> Value pairs). NOTE: some of these details are obtained from third party information.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lussumo vanilla | <= 1.1.5-rc1 | No fix listed |
| lussumo vanilla | = 0.9.2 | No fix listed |
| lussumo vanilla | = 1 | No fix listed |
| lussumo vanilla | = 1.0.1 | No fix listed |
| lussumo vanilla | = 1.0.2 | No fix listed |
| lussumo vanilla | = 1.0.3 | No fix listed |
| lussumo vanilla | = 1.1 | No fix listed |
| lussumo vanilla | = 1.1.1 | No fix listed |
| lussumo vanilla | = 1.1.2 | No fix listed |
| lussumo vanilla | = 1.1.3 | No fix listed |
| lussumo vanilla | = 1.1.4 | No fix listed |
References
- lussumo.com
- lussumo.com
- 31527 third-party-advisory vendor-advisory
- 4176 third-party-advisory
- www.gulftech.org
- 20080819 Vanilla <= 1.1.4 Script Injection/ XSS mailing-list
- 30748 exploit vdb-entry