Unscored severity · published May 22, 2007
CVE-2007-2808
Cross-site scripting (XSS) vulnerability in gnatsweb.pl in Gnatsweb 4.00 and Gnats 4.1.99 allows remote attackers to inject arbitrary web script or HTML via the database parameter
–
CVSS
1.3%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in gnatsweb.pl in Gnatsweb 4.00 and Gnats 4.1.99 allows remote attackers to inject arbitrary web script or HTML via the database parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GN
Gnats · Gnu
4.1.99 · source: NVD
GN
Gnatsweb · Yngve Svendsen
4.00 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-2808
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-2808
osvdb.org
http://osvdb.org/36224
pridels-team.blogspot.com
http://pridels-team.blogspot.com/2007/05/blog-post.html
Vendor Advisory
http://secunia.com/advisories/25333
secunia.com
http://secunia.com/advisories/28743
www.debian.org
http://www.debian.org/security/2008/dsa-1486
www.securityfocus.com
http://www.securityfocus.com/bid/24081
More from Gnats
–
CVE-2005-2180
gen-index in GNATS 4.0, 4.1.0, and possibly earlier versions, when installed setuid, does not properly check files passed to the -o argument and opens the file with write access,…
–
CVE-2004-0623
Format string vulnerability in misc.c in GNU GNATS 4.00 may allow remote attackers to execute arbitrary code via format string specifiers in a string that gets logged by syslog