JVNDB-2006-000850

a-blog cross-site scripting vulnerability

a-blog, a server-based blog tool from appleple, Inc. contains a cross-site scripting vulnerability.

Base Metrics: 4.3 (Medium) [IPA Score]

• Access Vector: Network
• Access Complexity: Medium
• Authentication: None
• Confidentiality Impact: None
• Integrity Impact: Partial
• Availability Impact: None

appleple, Inc.

• a-blog 1.51 and earlier

An arbitrary script may be executed on the user's web browser. If session information from a cookie is leaked, an attacker could possibly conduct session hijacking.

appleple, Inc.

• a-blog NEWS : a-blog 1.52 (Japanese)

1. CVE-2006-6729

1. JVN : JVN#78520316
2. National Vulnerability Database (NVD) : CVE-2006-6729
3. Secunia Advisory : SA23444
4. FrSIRT Advisories : FrSIRT/ADV-2006-5129

[2008/05/21]
  Web page published