Unscored severity · published Sep 11, 2009
CVE-2008-7213
Cross-site scripting (XSS) vulnerability in mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and…
–
CVSS
2.2%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to inject arbitrary web script or HTML via the Command parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Mambo · Mambo-foundation
through 4.6.3; 4.6.2 · source: NVD
MO
Mostlyce · Brilaps
through 2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-7213
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-7213
archives.neohapsis.com
http://archives.neohapsis.com/archives/bugtraq/2008-02/0444.html
forum.mambo-foundation.org
http://forum.mambo-foundation.org/showthread.php?t=10158
osvdb.org
http://osvdb.org/42530
Vendor Advisory
http://secunia.com/advisories/28670
Exploit
http://www.bugreport.ir/index_33.htm
www.securityfocus.com
http://www.securityfocus.com/archive/1/487128/100/200/threaded
More from Mostlyce
–
CVE-2008-7215
The Image Manager in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to rename arbitrary files and cause a denial of service via modified…
–
CVE-2008-7214
Cross-site request forgery (CSRF) vulnerability in administrator/index2.php in MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to hijack the…
–
CVE-2008-7212
MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote attackers to obtain sensitive information via certain requests to…