FKIE_CVE-2012-0984

Vulnerability from fkie_nvd - Published: 2014-09-11 14:16 - Updated: 2026-06-16 23:38
Severity
Summary
Multiple cross-site scripting (XSS) vulnerabilities in XOOPS before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via the (1) to_userid parameter to modules/pm/pmlite.php or the (2) current_file, (3) imgcat_id, or (4) target parameter to class/xoopseditor/tinymce/tinymce/jscripts/tiny_mce/plugins/xoopsimagemanager/xoopsimagebrowser.php.
References
cve@mitre.orghttp://archives.neohapsis.com/archives/bugtraq/2012-04/0128.htmlExploit
cve@mitre.orghttp://osvdb.org/81212
cve@mitre.orghttp://osvdb.org/81213
cve@mitre.orghttp://packetstormsecurity.org/files/111958/XOOPS-2.5.4-Cross-Site-Scripting.htmlExploit
cve@mitre.orghttp://secunia.com/advisories/48887
cve@mitre.orghttp://www.exploit-db.com/exploits/18753Exploit
cve@mitre.orghttp://www.securityfocus.com/bid/53143
cve@mitre.orghttp://xoops.org/modules/news/article.php?storyid=6284Patch, Vendor Advisory
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/75024
cve@mitre.orghttps://www.htbridge.com/advisory/multiple_vulnerabilities_in_xoops.htmlExploit
af854a3a-2127-422b-91ae-364da2661108http://archives.neohapsis.com/archives/bugtraq/2012-04/0128.htmlExploit
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/81212
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/81213
af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.org/files/111958/XOOPS-2.5.4-Cross-Site-Scripting.htmlExploit
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/48887
af854a3a-2127-422b-91ae-364da2661108http://www.exploit-db.com/exploits/18753Exploit
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/53143
af854a3a-2127-422b-91ae-364da2661108http://xoops.org/modules/news/article.php?storyid=6284Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/75024
af854a3a-2127-422b-91ae-364da2661108https://www.htbridge.com/advisory/multiple_vulnerabilities_in_xoops.htmlExploit
Impacted products
Vendor Product Version
xoops xoops *
xoops xoops 2.5.0
xoops xoops 2.5.1
xoops xoops 2.5.2
xoops xoops 2.5.2
xoops xoops 2.5.3
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:xoops:xoops:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "42DF7B3A-901F-485D-9254-55678CE32D92",
              "versionEndIncluding": "2.5.4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xoops:xoops:2.5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "6DA9B414-29A9-42C8-A877-3D893ACCFF8A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xoops:xoops:2.5.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "9EA9FCEF-9E05-4DEC-9096-C02B12C548DF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xoops:xoops:2.5.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "B6BF6AA3-EA16-480A-B6C7-CF60DB5C1F9C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xoops:xoops:2.5.2:rc:*:*:*:*:*:*",
              "matchCriteriaId": "E773063D-3692-4320-ACB2-47360165847C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:xoops:xoops:2.5.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "2E8EF024-4538-46D0-98C5-1923FBE85FC8",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple cross-site scripting (XSS) vulnerabilities in XOOPS before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via the (1) to_userid parameter to modules/pm/pmlite.php or the (2) current_file, (3) imgcat_id, or (4) target parameter to class/xoopseditor/tinymce/tinymce/jscripts/tiny_mce/plugins/xoopsimagemanager/xoopsimagebrowser.php."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples vulnerabilidades de XSS en XOOPS anterior a 2.5.5 permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s del (1) par\u00e1metro to_userid en modules/pm/pmlite.php o (2) el par\u00e1metro current_file, (3) imgcat_id, o (4) target en class/xoopseditor/tinymce/tinymce/jscripts/tiny_mce/plugins/xoopsimagemanager/xoopsimagebrowser.php."
    }
  ],
  "id": "CVE-2012-0984",
  "lastModified": "2026-06-16T23:38:36.680",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2014-09-11T14:16:03.427",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://archives.neohapsis.com/archives/bugtraq/2012-04/0128.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/81212"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://osvdb.org/81213"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://packetstormsecurity.org/files/111958/XOOPS-2.5.4-Cross-Site-Scripting.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/48887"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.exploit-db.com/exploits/18753"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/53143"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://xoops.org/modules/news/article.php?storyid=6284"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75024"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "https://www.htbridge.com/advisory/multiple_vulnerabilities_in_xoops.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://archives.neohapsis.com/archives/bugtraq/2012-04/0128.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/81212"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/81213"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://packetstormsecurity.org/files/111958/XOOPS-2.5.4-Cross-Site-Scripting.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/48887"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "http://www.exploit-db.com/exploits/18753"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/53143"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://xoops.org/modules/news/article.php?storyid=6284"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75024"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "https://www.htbridge.com/advisory/multiple_vulnerabilities_in_xoops.html"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.