CVE-2010-5284

Published: Nov 26, 2012Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

Multiple cross-site scripting (XSS) vulnerabilities in Collabtive 0.6.5 allow remote attackers to inject arbitrary web script or HTML via the (1) User parameter in the edit user profile feature to manageuser.php, (2) y parameter in a newcal action to manageajax.php, and the (3) pic parameter to thumb.php.

Affected (1)

Products: O Dyn: Collabtive

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
O Dyn Collabtive	Version 0.6.5

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (10)

http://packetstormsecurity.org/1010-exploits/collabtive-xssxsrf.txt

Source: cve@mitre.org

http://secunia.com/advisories/41805

Source: cve@mitre.org

Vendor Advisory

http://www.anatoliasecurity.com/adv/as-adv-2010-003.txt

Source: cve@mitre.org

http://www.exploit-db.com/exploits/15240

Source: cve@mitre.org

http://www.securityfocus.com/bid/44050

Source: cve@mitre.org

Exploit

http://packetstormsecurity.org/1010-exploits/collabtive-xssxsrf.txt

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/41805

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.anatoliasecurity.com/adv/as-adv-2010-003.txt

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.exploit-db.com/exploits/15240

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/44050

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

Timeline

No history available yet.