« Volver al listado

CVE-2004-0067

Estado: ModificadaMedia (4.3)—💥 Exploit

Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en phpGedView anteriores a 2.65 permite a atacantes remotos inyectar HTML o script web arbitrario mediante (1) descendancy.php, (2) index.php, (3) individual.php, (4) login.php, (5) relationship.php, (6) source.php, (7) imageview.php, (8) calendar.php, (9) gedrecord.php, (10) login.php, y (11) gdbi_interface.php. NOTA: se ha informado posteriormente que algunos aspectos relativos al vector 10 también afectan a la v4.1.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

💥 Exploits públicos

Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.

Tecnologías afectadas (1)

Phpgedview — Phpgedview

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2004-0067",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2004-02-17T05:00:00.000",
  "references": [
    {
      "url": "http://marc.info/?l=bugtraq&m=107394912715478&w=2",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/26628",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securitytracker.com/id?1018613",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.osvdb.org/3473",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.osvdb.org/3474",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.osvdb.org/3475",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.osvdb.org/3476",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.osvdb.org/3477",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.osvdb.org/3478",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.osvdb.org/3479",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/477881/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/11868",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/11880",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/11882",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/11888",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/11890",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/11891",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/11894",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/11903",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/11904",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/11905",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/11906",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/11907",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2007/2995",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/14212",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36285",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://marc.info/?l=bugtraq&m=107394912715478&w=2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/26628",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securitytracker.com/id?1018613",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.osvdb.org/3473",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.osvdb.org/3474",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.osvdb.org/3475",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.osvdb.org/3476",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.osvdb.org/3477",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.osvdb.org/3478",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.osvdb.org/3479",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/477881/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/11868",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/11880",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/11882",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/11888",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/11890",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/11891",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/11894",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/11903",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/11904",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/11905",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/11906",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/11907",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2007/2995",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/14212",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36285",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple cross-site scripting (XSS) vulnerabilities in phpGedView before 2.65 allow remote attackers to inject arbitrary HTML or web script via (1) descendancy.php, (2) index.php, (3) individual.php, (4) login.php, (5) relationship.php, (6) source.php, (7) imageview.php, (8) calendar.php, (9) gedrecord.php, (10) login.php, and (11) gdbi_interface.php.  NOTE: some aspects of vector 10 were later reported to affect 4.1."
    },
    {
      "lang": "es",
      "value": "Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en phpGedView anteriores a 2.65 permite a atacantes remotos inyectar HTML o script web arbitrario mediante (1) descendancy.php, (2) index.php, (3) individual.php, (4) login.php, (5) relationship.php, (6) source.php, (7) imageview.php, (8) calendar.php, (9) gedrecord.php, (10) login.php, y (11) gdbi_interface.php. NOTA: se ha informado posteriormente que algunos aspectos relativos al vector 10 también afectan a la v4.1."
    }
  ],
  "lastModified": "2026-06-16T22:04:51.620",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:phpgedview:phpgedview:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C05501C0-BAF9-483E-A9CF-5F46D14E88FA",
              "versionEndIncluding": "2.65"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}