Unscored severity · published Jun 30, 2003
CVE-2003-0404
Multiple Cross Site Scripting (XSS) vulnerabilities in Vignette StoryServer 4 and 5, and Vignette V/5 and V/6, allow remote attackers to insert arbitrary HTML and script via text…
–
CVSS
2%
EPSS
No
On KEV
Description
Multiple Cross Site Scripting (XSS) vulnerabilities in Vignette StoryServer 4 and 5, and Vignette V/5 and V/6, allow remote attackers to insert arbitrary HTML and script via text variables, as demonstrated using the errInfo parameter of the default login template.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CS
Content Suite · Vignette
5.0; 6.0; 7.0 · source: NVD
ST
Storyserver · Vignette
4.0; 4.1; 5.0 · source: NVD
VI
Vignette · Vignette
5.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2003-0404
CVE.org
https://www.cve.org/CVERecord?id=CVE-2003-0404
marc.info
http://marc.info/?l=bugtraq&m=105406028027360&w=2
Vendor Advisory
http://www.iss.net/security_center/static/12071.php
Vendor Advisory
http://www.s21sec.com/es/avisos/s21sec-023-en.txt
Exploit
http://www.securityfocus.com/bid/7687
More from Content Suite
–
CVE-2003-0398
Vignette StoryServer 4 and 5, and Vignette V/5 and V/6, with the SSI EXEC feature enabled, allows remote attackers to execute arbitrary code via a text variable to a Vignette…
–
CVE-2003-0399
Vignette StoryServer 4 and 5, Vignette V/5, and possibly other versions allows remote attackers to perform unauthorized SELECT queries by setting the vgn_creds cookie to an…
–
CVE-2003-0402
The default login template (/vgn/login) in Vignette StoryServer 5 and Vignette V/5 generates different responses whether a user exists or not, which allows remote attackers to…
–
CVE-2003-0403
Vignette StoryServer 5 and Vignette V/5 allows remote attackers to read and modify license information, and cause a denial of service (service halt) by directly accessing the…
–
CVE-2003-0400
Vignette StoryServer and Vignette V/5 does not properly calculate the size of text variables, which causes Vignette to return unauthorized portions of memory, as demonstrated…