CVE-2012-2099 - Vulnerability Details - OpenCVE

Multiple cross-site scripting (XSS) vulnerabilities in Wikidforum 2.10 allow remote attackers to inject arbitrary web script or HTML via the (1) search field, or the (2) Author or (3) select_sort parameters in an advanced search.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Wikidforum	Wikidforum

Configuration 1 [-]

cpe:2.3:a:wikidforum:wikidforum:2.10:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://archives.neohapsis.com/archives/bugtraq/2012-03/0046.html
http://www.darksecurity.de/advisories/2012/SSCHADV2012-005.txt
http://www.openwall.com/lists/oss-security/2012/04/12/12
http://www.openwall.com/lists/oss-security/2012/04/12/5
http://www.osvdb.org/80838
http://www.osvdb.org/80839
http://www.securityfocus.com/bid/52425
http://www.wikidforum.com/forum/forum-software_29/wikidforum-support_31/sschadv2012-005-unfixed-xss-and-sql-injection-security-vulnerabilities_188.html
https://exchange.xforce.ibmcloud.com/vulnerabilities/73985

History

No history.

MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2013-01-24T01:00:00

Updated: 2024-08-06T19:26:07.642Z

Reserved: 2012-04-04T00:00:00

Link: CVE-2012-2099

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2013-01-24T01:55:02.737

Modified: 2025-04-11T00:51:21.963

Link: CVE-2012-2099

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2012-03-10T00:00:00", "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in Wikidforum 2.10 allow remote attackers to inject arbitrary web script or HTML via the (1) search field, or the (2) Author or (3) select_sort parameters in an advanced search."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-28T12:57:01", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"tags": ["x_refsource_MISC"], "url": "http://www.wikidforum.com/forum/forum-software_29/wikidforum-support_31/sschadv2012-005-unfixed-xss-and-sql-injection-security-vulnerabilities_188.html"}, {"name": "20120310 Wikidforum 2.10 Multiple security vulnerabilities", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://archives.neohapsis.com/archives/bugtraq/2012-03/0046.html"}, {"name": "80838", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/80838"}, {"tags": ["x_refsource_MISC"], "url": "http://www.darksecurity.de/advisories/2012/SSCHADV2012-005.txt"}, {"name": "[oss-security] 20120412 Re: CVE-request: Wikidforum 2.10 multiple XSS and SQL-injection vulnerabilities SSCHADV2012-005", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2012/04/12/12"}, {"name": "[oss-security] 20120412 CVE-request: Wikidforum 2.10 multiple XSS and SQL-injection vulnerabilities SSCHADV2012-005", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2012/04/12/5"}, {"name": "52425", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/52425"}, {"name": "80839", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://www.osvdb.org/80839"}, {"name": "wikidforum-search-xss(73985)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/73985"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2012-2099", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Multiple cross-site scripting (XSS) vulnerabilities in Wikidforum 2.10 allow remote attackers to inject arbitrary web script or HTML via the (1) search field, or the (2) Author or (3) select_sort parameters in an advanced search."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://www.wikidforum.com/forum/forum-software_29/wikidforum-support_31/sschadv2012-005-unfixed-xss-and-sql-injection-security-vulnerabilities_188.html", "refsource": "MISC", "url": "http://www.wikidforum.com/forum/forum-software_29/wikidforum-support_31/sschadv2012-005-unfixed-xss-and-sql-injection-security-vulnerabilities_188.html"}, {"name": "20120310 Wikidforum 2.10 Multiple security vulnerabilities", "refsource": "BUGTRAQ", "url": "http://archives.neohapsis.com/archives/bugtraq/2012-03/0046.html"}, {"name": "80838", "refsource": "OSVDB", "url": "http://www.osvdb.org/80838"}, {"name": "http://www.darksecurity.de/advisories/2012/SSCHADV2012-005.txt", "refsource": "MISC", "url": "http://www.darksecurity.de/advisories/2012/SSCHADV2012-005.txt"}, {"name": "[oss-security] 20120412 Re: CVE-request: Wikidforum 2.10 multiple XSS and SQL-injection vulnerabilities SSCHADV2012-005", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2012/04/12/12"}, {"name": "[oss-security] 20120412 CVE-request: Wikidforum 2.10 multiple XSS and SQL-injection vulnerabilities SSCHADV2012-005", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2012/04/12/5"}, {"name": "52425", "refsource": "BID", "url": "http://www.securityfocus.com/bid/52425"}, {"name": "80839", "refsource": "OSVDB", "url": "http://www.osvdb.org/80839"}, {"name": "wikidforum-search-xss(73985)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/73985"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T19:26:07.642Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.wikidforum.com/forum/forum-software_29/wikidforum-support_31/sschadv2012-005-unfixed-xss-and-sql-injection-security-vulnerabilities_188.html"}, {"name": "20120310 Wikidforum 2.10 Multiple security vulnerabilities", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://archives.neohapsis.com/archives/bugtraq/2012-03/0046.html"}, {"name": "80838", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/80838"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.darksecurity.de/advisories/2012/SSCHADV2012-005.txt"}, {"name": "[oss-security] 20120412 Re: CVE-request: Wikidforum 2.10 multiple XSS and SQL-injection vulnerabilities SSCHADV2012-005", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2012/04/12/12"}, {"name": "[oss-security] 20120412 CVE-request: Wikidforum 2.10 multiple XSS and SQL-injection vulnerabilities SSCHADV2012-005", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2012/04/12/5"}, {"name": "52425", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/52425"}, {"name": "80839", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://www.osvdb.org/80839"}, {"name": "wikidforum-search-xss(73985)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/73985"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2012-2099", "datePublished": "2013-01-24T01:00:00", "dateReserved": "2012-04-04T00:00:00", "dateUpdated": "2024-08-06T19:26:07.642Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wikidforum:wikidforum:2.10:*:*:*:*:*:*:*", "matchCriteriaId": "69426D0B-4563-4A86-90EA-DA3ACBF82D0C", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in Wikidforum 2.10 allow remote attackers to inject arbitrary web script or HTML via the (1) search field, or the (2) Author or (3) select_sort parameters in an advanced search."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en Wikidforum v2.10 permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s del (1) campo \"search\" o del (2) \"Author\" o (3) los par\u00e1metros \"select_sort\" en la b\u00fasqueda avanzada."}], "id": "CVE-2012-2099", "lastModified": "2025-04-11T00:51:21.963", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": true}]}, "published": "2013-01-24T01:55:02.737", "references": [{"source": "[email protected]", "tags": ["Exploit"], "url": "http://archives.neohapsis.com/archives/bugtraq/2012-03/0046.html"}, {"source": "[email protected]", "tags": ["Exploit"], "url": "http://www.darksecurity.de/advisories/2012/SSCHADV2012-005.txt"}, {"source": "[email protected]", "url": "http://www.openwall.com/lists/oss-security/2012/04/12/12"}, {"source": "[email protected]", "url": "http://www.openwall.com/lists/oss-security/2012/04/12/5"}, {"source": "[email protected]", "url": "http://www.osvdb.org/80838"}, {"source": "[email protected]", "url": "http://www.osvdb.org/80839"}, {"source": "[email protected]", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/52425"}, {"source": "[email protected]", "url": "http://www.wikidforum.com/forum/forum-software_29/wikidforum-support_31/sschadv2012-005-unfixed-xss-and-sql-injection-security-vulnerabilities_188.html"}, {"source": "[email protected]", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/73985"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://archives.neohapsis.com/archives/bugtraq/2012-03/0046.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://www.darksecurity.de/advisories/2012/SSCHADV2012-005.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2012/04/12/12"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2012/04/12/5"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/80838"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.osvdb.org/80839"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://www.securityfocus.com/bid/52425"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.wikidforum.com/forum/forum-software_29/wikidforum-support_31/sschadv2012-005-unfixed-xss-and-sql-injection-security-vulnerabilities_188.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/73985"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "[email protected]", "type": "Primary"}]}