Vulnerability Details : CVE-2005-4481
Cross-site scripting (XSS) vulnerability in Polopoly 9 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters. NOTE: the vendor has disputed this vulnerability, stating that the "XSS flaw was only part of the custom implementation of the [polopoly] site". As of 20061003, CVE has no further information on this issue, except that the original researcher has a history of testing live sites and assuming that discoveries indicate vulnerabilities in the associated package
Vulnerability category: Cross site scripting (XSS)
Products affected by CVE-2005-4481
- cpe:2.3:a:polopoly:polopoly:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2005-4481
0.53%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 74 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2005-4481
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST |
Vendor statements for CVE-2005-4481
-
Polopoly 2006-10-051. The XSS flaw described was only part of the custom implementation of the http://www.polopoly.com/ site. It was never part of any version of any Polopoly product, nor delivered to any of Polopoly’s customers. 2. The XSS flaw that existed (the search form in the upper right corner) on the www.polopoly.com site has been fixed. 3. When www.polopoly.com had the XSS flaw it was based on Polopoly 8.6. Polopoly 9.x was never involved what so ever in this issue. And as I said earlier, the flaw was not part of Polopoly 8.6 either, it was only in custom implementation code of the www.polopoly.com site. 4. The www.polopoly.com site is not personalized nor permission controlled, so there was no information of any value to steal by exploiting the XSS flaw.
References for CVE-2005-4481
-
http://www.securityfocus.com/bid/16007
-
http://www.osvdb.org/21878
404 Not Found
-
http://pridels0.blogspot.com/2005/12/polopoly-xss-vuln.html
Blog not found
-
http://attrition.org/pipermail/vim/2006-September/001056.html
[VIM] vendor dispute: 21878: Polopoly Search Module XSS (fwd)
Jump to