Back to search
CVE-2005-2204
Published: Jul 11, 2005
Modified: Aug 7, 2024
PUBLISHED
Description
Cross-site scripting (XSS) vulnerability in Computer Associates (CA) eTrust SiteMinder 5.5, when the "CSSChecking" parameter is set to "NO," allows remote attackers to inject arbitrary web script or HTML via the (1) PASSWORD or (2) BUFFER parameters to smpwservicescgi.exe, (3) the TARGET parameter to login.fcc, and possibly other vectors.
| Vendor | Product | Versions |
|---|---|---|
n/a | n/a | affected n/a |
References
1014433
vdb-entry
x_refsource_SECTRACK
15956
third-party-advisory
x_refsource_SECUNIA
17809
vdb-entry
x_refsource_OSVDB
ca-siteminder-smpwservicescgi-xss(21305)
vdb-entry
x_refsource_XF
17810
vdb-entry
x_refsource_OSVDB
20050711 Re: SiteMinder Multiple Vulnerabilities
mailing-list
x_refsource_BUGTRAQ
20050708 SiteMinder Multiple Vulnerabilities
mailing-list
x_refsource_BUGTRAQ
ADV-2005-1040
vdb-entry
x_refsource_VUPEN
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now