NVD

Id
1449  
Name
CVE-2008-1502  
Description
The _bad_protocol_once function in phpgwapi/inc/class.kses.inc.php in KSES, as used in eGroupWare before 1.4.003, Moodle before 1.8.5, and other products, allows remote attackers to bypass HTML filtering and conduct cross-site scripting (XSS) attacks via a string containing crafted URL protocols.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-03  
Published
2008-03-25  
Modified Date
2012-11-26  
Seq
2008-1502  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
9440 1449 CVE-2008-1502 http://docs.moodle.org/en/Release_Notes#Moodle_1.8.5  View
9441 1449 CVE-2008-1502 SUSE-SR:2008:015  View
9442 1449 CVE-2008-1502 DSA-1691  View
9443 1449 CVE-2008-1502 DSA-1871  View
9444 1449 CVE-2008-1502 http://www.egroupware.org/changelog  View
9445 1449 CVE-2008-1502 http://www.egroupware.org/viewvc/branches/1.4/phpgwapi/inc/class.kses.inc.php?r1=23625&r2=25110&pathrev=25110  View
9446 1449 CVE-2008-1502 GLSA-200805-04  View
9447 1449 CVE-2008-1502 [oss-security] 20080708 Re: CVE request: moodle xss in < 1.8.5  View
9448 1449 CVE-2008-1502 28424  View
9449 1449 CVE-2008-1502 USN-658-1  View
9450 1449 CVE-2008-1502 ADV-2008-0989  View
9451 1449 CVE-2008-1502 egroupware-badprotocolonce-security-bypass(41435)  View
9452 1449 CVE-2008-1502 FEDORA-2008-6226  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
47576 JVNDB-2008-002886 eGroupWare で使用される KSES におけるクロスサイトスクリプティング攻撃を実行される脆弱性 eGroupWare、Moodle およびその他の製品で使用される KSES の phpgwapi/inc/class.kses.inc.php の_bad_protocol_once 関数には、HTML フィルタを回避され、クロスサイトスクリプティング攻撃を実行される脆弱性が存在します。 CVE-2008-1502 31615 CVE-2008-1502 1449 4.3 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-002886.html 2008-03-25 2012-06-26 View