CVE-2008-6945

Multiple cross-site scripting (XSS) vulnerabilities in Interchange 5.7 before 5.7.1, 5.6 before 5.6.1, and 5.4 before 5.4.3 allow remote attackers to inject arbitrary web script or HTML via (1) the mv_order_item CGI variable parameter in Core, (2) the country-select widget, or (3) possibly the value specifier when used in the UserTag feature.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.3 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 66%
VendorProductVersion
icdevgroupinterchange
5.4.0
icdevgroupinterchange
5.4.1
icdevgroupinterchange
5.4.2
icdevgroupinterchange
5.6.0
icdevgroupinterchange
5.7.0
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
interchange
oneiric
not-affected
natty
not-affected
maverick
not-affected
lucid
not-affected
karmic
not-affected
jaunty
not-affected
intrepid
ignored
hardy
ignored
dapper
ignored
Common Weakness Enumeration
References
http://ftp.icdevgroup.org/interchange/5.7/WHATSNEW
http://osvdb.org/49852
http://osvdb.org/49853
http://secunia.com/advisories/32658
http://www.icdevgroup.org/i/dev/news?id=ssEkj9j8&mv_arg=00030&mv_pc=96
http://www.securityfocus.com/bid/32297
https://exchange.xforce.ibmcloud.com/vulnerabilities/46598
https://exchange.xforce.ibmcloud.com/vulnerabilities/46599
http://ftp.icdevgroup.org/interchange/5.7/WHATSNEW
http://osvdb.org/49852
http://osvdb.org/49853
http://secunia.com/advisories/32658
http://www.icdevgroup.org/i/dev/news?id=ssEkj9j8&mv_arg=00030&mv_pc=96
http://www.securityfocus.com/bid/32297
https://exchange.xforce.ibmcloud.com/vulnerabilities/46598
https://exchange.xforce.ibmcloud.com/vulnerabilities/46599