VulnerabilityModified

CVE-2012-0873

Multiple cross-site scripting (XSS) vulnerabilities in Boonex Dolphin before 7.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) explain parameter to explanation.php or the (2) photos_only, (3) online_only, or (4) mode…

MEDIUM 4.3EPSS 4.25%

Does this matter?

Lower severity and a low EPSS score (4.25%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 2.0: 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS: 4.25% probability · 90th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: boonex/dolphin
Source: secalert@redhat.com

References

http://archives.neohapsis.com/archives/bugtraq/2012-02/0107.htmlExploit
http://www.boonex.com/n/dolphin-7-0-8-released
http://www.boonex.com/trac/dolphin/changeset/15282Patch
http://www.boonex.com/trac/dolphin/changeset/15283Exploit, Patch
http://www.boonex.com/trac/dolphin/ticket/2530Patch
http://www.openwall.com/lists/oss-security/2012/02/20/11Exploit
http://www.openwall.com/lists/oss-security/2012/02/20/6Exploit
http://www.securityfocus.com/bid/52088Exploit
http://yehg.net/lab/pr0js/advisories/%5BDolphin_7.0.7%5D_xssExploit
http://archives.neohapsis.com/archives/bugtraq/2012-02/0107.htmlExploit
http://www.boonex.com/n/dolphin-7-0-8-released
http://www.boonex.com/trac/dolphin/changeset/15282Patch
http://www.boonex.com/trac/dolphin/changeset/15283Exploit, Patch
http://www.boonex.com/trac/dolphin/ticket/2530Patch
http://www.openwall.com/lists/oss-security/2012/02/20/11Exploit
http://www.openwall.com/lists/oss-security/2012/02/20/6Exploit
http://www.securityfocus.com/bid/52088Exploit
http://yehg.net/lab/pr0js/advisories/%5BDolphin_7.0.7%5D_xssExploit

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.