PT-2009-3852 · Zazzle · Zazzle Store Builder
CVE-2009-1320
·
Publicado
2009-04-17
·
Atualizado
2009-04-17
CVSS v2.0
4.3
Média
| Vetor | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Zazzle Store Builder version 1.0.2
Description
The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The vulnerable parameters are
gridPage and gridSort.Recommendations
For Zazzle Store Builder version 1.0.2, consider restricting access to the
include/zstore.php file until a patch is available. As a temporary workaround, avoid using the gridPage and gridSort parameters in the affected API endpoint.Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Zazzle Store Builder