CVE-2005-4637
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Kayako SupportSuite 3.00.26 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) nav parameter in the downloads module, (2) Full Name and (3) Email…
Does this matter?
Lower severity and a low EPSS score (1.75%). Track it; it rarely justifies an emergency change on its own.
Description
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Kayako SupportSuite 3.00.26 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) nav parameter in the downloads module, (2) Full Name and (3) Email fields in the core module, (4) Full Name, (5) Email, and (6) Subject fields in the tickets module, or (7) Registered Email field in the lostpassword feature in the core module.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 1.75% probability · 77th percentile
- CISA KEV
- Not listed
- Source
- cve@mitre.org
References
- http://pridels0.blogspot.com/2005/12/kayako-supportsuite-multiple-vuln.html
- http://www.osvdb.org/22224
- http://www.osvdb.org/22225
- http://www.securityfocus.com/bid/16094Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/23916
- http://pridels0.blogspot.com/2005/12/kayako-supportsuite-multiple-vuln.html
- http://www.osvdb.org/22224
- http://www.osvdb.org/22225
- http://www.securityfocus.com/bid/16094Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/23916
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.