Vulnerabilities > CVE-2005-4621 - Cross-Site Scripting vulnerability in VBulletin

CVSS 4.3 - MEDIUM

Attack vector

NETWORK

Attack complexity

MEDIUM

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

PARTIAL

Availability impact

NONE

network

jelsoft

NVD

Published: 2005-12-31

Updated: 2008-09-20

Summary

Cross-site scripting (XSS) vulnerability in the editavatar page in vBulletin 3.5.1 allows remote attackers to inject arbitrary web script or HTML via a URL in the remote avatar url field, in which the URL generates a parsing error, and possibly requiring a trailing extension such as .jpg.

Vulnerable Configurations

Part	Description	Count
Application	Jelsoft Jelsoft Vbulletin 1.0.1 Jelsoft Vbulletin 2.0.3 Jelsoft Vbulletin 2.0_Rc2 Jelsoft Vbulletin 2.0_Rc3 Jelsoft Vbulletin 2.2.0 Jelsoft Vbulletin 2.2.1 Jelsoft Vbulletin 2.2.2 Jelsoft Vbulletin 2.2.3 Jelsoft Vbulletin 2.2.4 Jelsoft Vbulletin 2.2.5 Jelsoft Vbulletin 2.2.6 Jelsoft Vbulletin 2.2.7 Jelsoft Vbulletin 2.2.8 Jelsoft Vbulletin 2.2.9 Jelsoft Vbulletin 2.3.0 Jelsoft Vbulletin 2.3.2 Jelsoft Vbulletin 2.3.3 Jelsoft Vbulletin 2.3.4 Jelsoft Vbulletin 2.3.8 Jelsoft Vbulletin 3.0 Jelsoft Vbulletin 3.0.1 Jelsoft Vbulletin 3.0.2 Jelsoft Vbulletin 3.0.3 Jelsoft Vbulletin 3.0.4 Jelsoft Vbulletin 3.0.5 Jelsoft Vbulletin 3.0.6 Jelsoft Vbulletin 3.0.7 Jelsoft Vbulletin 3.0.8 Jelsoft Vbulletin 3.0.9 Jelsoft Vbulletin 3.0.10 Jelsoft Vbulletin 3.0_Beta_2 Jelsoft Vbulletin 3.0_Beta_3 Jelsoft Vbulletin 3.0_Beta_4 Jelsoft Vbulletin 3.0_Beta_5 Jelsoft Vbulletin 3.0_Beta_6 Jelsoft Vbulletin 3.0_Beta_7 Jelsoft Vbulletin 3.0_Gamma Jelsoft Vbulletin 3.5.1	38

Summary

Vulnerable Configurations

References