CVE-2012-5919

Havalite CMS 1.0.4 - Multiple Vulnerabilities

Severity Score

4.3

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Multiple cross-site scripting (XSS) vulnerabilities in Havalite 1.0.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) find or (2) replace fields to havalite/findReplace.php; (3) username parameter to havalite/hava_login.php, (4) the Edit Article module, or (5) hava_post.php in the postAuthor module; (6) postId parameter to hava_post.php; (7) userId parameter to hava_user.php; or (8) linkId parameter to hava_link.php.

Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados en Havalite v1.0.4 y anteriores, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de los camposo (1) find o (2) replace a havalite/findReplace.php; el parámetro (3) username a havalite/hava_login.php, el módulo (4) Edit Article, o (5) hava_post.php en el módulo postAuthor; el parámetro (6) postId a hava_post.php; el parámetro (7) userId a hava_user.php; o el parámetro (8) linkId a hava_link.php.

*Credits: N/A

CVSS Scores

NISTv2 4.3

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2012-04-23 First Exploit
2012-11-18 CVE Reserved
2012-11-19 CVE Published
2023-03-07 EPSS Updated
2024-08-06 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CAPEC

References (7)

URL	Tag	Source
http://osvdb.org/81324	Vdb Entry
http://osvdb.org/81325	Vdb Entry
http://www.vulnerability-lab.com/get_content.php?id=520	X_refsource_misc
https://exchange.xforce.ibmcloud.com/vulnerabilities/75082	Vdb Entry

URL	Date	SRC
https://www.exploit-db.com/exploits/18772	2012-04-23
http://packetstormsecurity.org/files/112089/Havalite-CMS-1.0.4-Cross-Site-Scripting.html	2024-08-06

URL	Date	SRC

URL	Date	SRC
http://secunia.com/advisories/48646	2017-08-29

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Havalite Search vendor "Havalite"		Cms Search vendor "Havalite" for product "Cms"				<= 1.0.4 Search vendor "Havalite" for product "Cms" and version " <= 1.0.4"		-		Affected