« Volver al listado

CVE-2007-5227

Estado: ModificadaMedia (4.3)—

Multiple cross-site scripting (XSS) vulnerabilities in messaging/course/composeMessage.jsp in BlackBoard Learning System 6.3.1.593 and earlier in BlackBoard Academic Suite allow remote attackers to inject arbitrary web script or HTML via the (1) subject_t and (2) body_text parameters. NOTE: vector 2 requires bypassing a client-side security mechanism that attempts to block XSS sequences.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Blackboard — Blackboard Learning AND Community Post Systems

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2007-5227",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2007-10-05T23:17:00.000",
  "references": [
    {
      "url": "http://osvdb.org/37427",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/27005",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://trew.icenetx.net/toolz/advisory-blackboard-messages-en.txt",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/25929",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/37427",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/27005",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://trew.icenetx.net/toolz/advisory-blackboard-messages-en.txt",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/25929",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple cross-site scripting (XSS) vulnerabilities in messaging/course/composeMessage.jsp in BlackBoard Learning System 6.3.1.593 and earlier in BlackBoard Academic Suite allow remote attackers to inject arbitrary web script or HTML via the (1) subject_t and (2) body_text parameters.  NOTE: vector 2 requires bypassing a client-side security mechanism that attempts to block XSS sequences."
    },
    {
      "lang": "es",
      "value": "Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en messaging/course/composeMessage.jsp en BlackBoard Learning System 6.3.1.593 y anteriores en BlackBoard Academic Suite permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de los parámetros (1) subject_t y (2) body_text. NOTA: el vector 2 requiere pasar un mecanismo de seguridad cliete que intenta bloquear las secuencias XSS."
    }
  ],
  "lastModified": "2026-06-16T22:45:41.113",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:blackboard:blackboard_learning_and_community_post_systems:6.3.1.593:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "84E509AA-5CEE-4FEA-8C28-7A5BCD2D1D5A"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}