CVEvulnerability
CVE-2007-4912
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2007-09-17
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Cross-site scripting (XSS) vulnerability in ips_kernel/class_ajax.php in Invision Power Board (IPB or IP.Board) 2.3.1 up to 20070912 allows remote attackers to inject arbitrary web script or HTML into user profile fields via unspecified vectors related to character sets other than iso-8859-1 or utf-8.
Affected configurations
• invision power services invision power board 2.1.5 2006-03-08
• invision power services invision power board 2.1.5 2006-04-25
• invision power services invision power board 2.1.6
• invision power services invision power board 2.2
• invision power services invision power board 2.2.1
• invision power services invision power board 2.2.2
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://forums.invisionpower.com/index.php?act=attach&type=post&id=11870 forums.invisionpower.com
- http://forums.invisionpower.com/index.php?showtopic=237075 Patch
- http://secunia.com/advisories/26788 Patch, Vendor Advisory
- http://www.securityfocus.com/bid/25656 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/36589 exchange.xforce.ibmcloud.com
- http://forums.invisionpower.com/index.php?act=attach&type=post&id=11870 forums.invisionpower.com
- http://forums.invisionpower.com/index.php?showtopic=237075 Patch
- http://secunia.com/advisories/26788 Patch, Vendor Advisory
- http://www.securityfocus.com/bid/25656 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/36589 exchange.xforce.ibmcloud.com