CVEvulnerability

CVE-2002-0292

2.6 LOW Published 2002-05-31 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2002-05-31
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
2.6 LOW — AV:N/AC:H/Au:N/C:P/I:N/A:N

Description

Cross-site scripting vulnerability in Slash before 2.2.5, as used in Slashcode and elsewhere, allows remote attackers to steal cookies and authentication information from other users via Javascript in a URL, possibly in the formkey field.

Affected configurations

• open source development network slashcode (<= 1.0.8) • open source development network slashcode 2.0 • open source development network slashcode 2.1 • open source development network slashcode 2.1.1 • open source development network slashcode 2.2 • open source development network slashcode 2.2.1 • open source development network slashcode 2.2.2 • open source development network slashcode 2.2.3 • open source development network slashcode 2.2.4

References