« Volver al listado

CVE-2007-1768

Estado: ModificadaMedia (4.3)—

Vulnerabilidad de secuencia de comados en sitios cruzados (XSS) en app/helpers/application_helper.rb en Mephisto 0.7.3 y Mephisto Edge 20070325 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del campo nombre del autor en un comentario.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Mephisto — MephistoMephisto — Mephisto Edge

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2007-1768",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2007-03-30T01:19:00.000",
  "references": [
    {
      "url": "http://osvdb.org/35309",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securityreason.com/securityalert/2490",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/463825/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/23137",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33230",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/35309",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securityreason.com/securityalert/2490",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/463825/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/23137",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33230",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in app/helpers/application_helper.rb in Mephisto 0.7.3 and Mephisto Edge 20070325 allows remote attackers to inject arbitrary web script or HTML via the author name field in a comment."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de secuencia de comados en sitios cruzados (XSS) en app/helpers/application_helper.rb en Mephisto 0.7.3 y Mephisto Edge 20070325 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del campo nombre del autor en un comentario."
    }
  ],
  "lastModified": "2026-06-16T22:38:15.390",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mephisto:mephisto:0.7.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "950A628A-6EFF-4366-B858-A6A259358D66"
            },
            {
              "criteria": "cpe:2.3:a:mephisto:mephisto_edge:2007-03-25:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "20020EE7-9C5F-4784-8351-BB8D151C1358"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}