« Volver al listado

CVE-2006-7050

Estado: ModificadaMedia (6.8)—

Vulnerabilida de secuencia de comandos en sitios cruzados (XSS) en WikkaWiki (Wikka Wiki) anterior a 1.1.6.2 permite a atacantes remotos inyectar javascript de su elección a través de (1) eventos en enlaces forzados (parámetro url) que no son manejadas adecuadamente en formatters/wakka.php, y posiblemente (2) otros vectores en wikka.php.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Wikkawiki — Wikkawiki

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2006-7050",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": true,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2007-02-24T00:28:00.000",
  "references": [
    {
      "url": "http://secunia.com/advisories/20628",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://wikkawiki.org/WikkaReleaseNotes",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://wush.net/trac/wikka/changeset/47",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://wush.net/trac/wikka/ticket/142",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/18481",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2006/2381",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27227",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/20628",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://wikkawiki.org/WikkaReleaseNotes",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://wush.net/trac/wikka/changeset/47",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://wush.net/trac/wikka/ticket/142",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/18481",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2006/2381",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27227",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in WikkaWiki (Wikka Wiki) before 1.1.6.2 allows remote attackers to inject arbitrary javascript via (1) events in forced links (url parameter) that are not properly handled in formatters/wakka.php, and possibly (2) other vectors in wikka.php."
    },
    {
      "lang": "es",
      "value": "Vulnerabilida de secuencia de comandos en sitios cruzados (XSS) en WikkaWiki (Wikka Wiki) anterior a 1.1.6.2 permite a atacantes remotos inyectar javascript de su elección a través de (1) eventos en enlaces forzados (parámetro url) que no son manejadas adecuadamente en formatters/wakka.php, y posiblemente (2) otros vectores en wikka.php."
    }
  ],
  "lastModified": "2026-06-16T22:34:17.427",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wikkawiki:wikkawiki:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "98ABA654-0C36-4611-87A0-4DC94592BB17",
              "versionEndIncluding": "1.1.6.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}