The version of CuteNews installed on the remote host is vulnerable to a cross-site scripting (XSS) attack.  An attacker, exploiting this flaw, would need to be able to coerce a user to browse to a purposefully malicious URI.  Upon successful exploitation, the attacker would be able to run code within the web-browser in the security context of the CuteNews server.

リモートホストにインストールされているCuteNewsのバージョンは、クロスサイトスクリプティング（XSS）攻撃に脆弱です。この欠陥を悪用する攻撃者は、意図的に悪意のあるURIを閲覧するようにユーザーを強制できる必要があります。悪用に成功すると、攻撃者はCuteNewsサーバーのセキュリティコンテキストでWebブラウザ内のコードを実行できるようになります。

遠端主機上安裝的 CuteNews 版本容易遭受跨網站指令碼 (XSS) 攻擊。攻擊者要利用此弱點，必須要能夠強制使用者瀏覽惡意構建的 URI。若成功利用此弱點，攻擊者可在 CuteNews 伺服器的安全性內容中執行網頁瀏覽器中的程式碼。

远程主机上安装的 CuteNews 版本容易遭受跨站脚本 (XSS) 攻击。利用此缺陷的攻击者需要能够强制用户浏览到有目的的恶意 URI。若成功利用此漏洞，攻击者便可在 CuteNews 服务器的安全环境中运行 Web 浏览器内的代码。

According to its version number, the remote host is running a version of CuteNews that allows an attacker to inject arbitrary script through the variables 'X-FORWARDED-FOR' or 'CLIENT-IP' when adding a comment. On one hand, an attacker can inject a client-side script to be executed by an administrator's browser when he/she chooses to edit the added comment.  On the other, an attacker with local access could leverage this flaw to run arbitrary PHP code in the context of the web server user.  Additionally, it suffers from a cross-site scripting flaw involving the 'search.php' script.

ID	名稱	產品	系列	已發布	已更新	嚴重性
14665	CuteNews index.php mod Parameter XSS	Nessus	CGI abuses : XSS	2004/9/6	2021/1/19	medium
14665	CuteNews index.php modのパラメーターXSS	Nessus	CGI abuses : XSS	2004/9/6	2021/1/19	medium
14665	CuteNews index.php mod 參數 XSS	Nessus	CGI abuses : XSS	2004/9/6	2021/1/19	medium
14665	CuteNews index.php mod 参数 XSS	Nessus	CGI abuses : XSS	2004/9/6	2021/1/19	medium
2253	CuteNews <= 1.3.6 Multiple XSS / Code Execution	Nessus Network Monitor	Web Servers	2004/9/3	2019/3/6	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium