CVE-2005-4398 (CNNVD-200512-441)
中文标题:
Lemoon/Damoon搜索模块跨站脚本攻击漏洞
英文标题:
NOTE: the vendor has disputed this issue. Cross-site scripting (XSS) vulnerability in lemoon 2.0 an...
漏洞描述
中文描述:
** 争议 ** 注：厂商对此问题有争议。Iemoon 2.0中存在跨站脚本攻击漏洞，远程攻击者可以通过未明搜索参数，可能是q参数，注入任意Web脚本或HTML。
英文描述:
NOTE: the vendor has disputed this issue. Cross-site scripting (XSS) vulnerability in lemoon 2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters, possibly the q parameter. NOTE: the vendor has disputed this issue, saying "Sites are built on top of ASP.NET and you use lemoon core objects to easily manage and render content. The XSS vuln. you are referring to exists in one of our public sites built on lemoon i.e. a custom made site (as all sites are). The problem exists in a UserControl that handles form input and is in no way related to the lemoon core product.
CWE类型:
标签:
受影响产品
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
AV:N/AC:M/Au:N/C:N/I:P/A:N
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2005-4398 |
2025-11-11 15:17:37 | 2025-11-11 07:32:30 |
| NVD | nvd_CVE-2005-4398 |
2025-11-11 14:51:21 | 2025-11-11 07:41:15 |
| CNNVD | cnnvd_CNNVD-200512-441 |
2025-11-11 15:08:49 | 2025-11-11 07:49:02 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 跨站脚本
- cnnvd_id: 未提取 -> CNNVD-200512-441
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- cvss_score: 未提取 -> 4.3
- cvss_vector: NOT_EXTRACTED -> AV:N/AC:M/Au:N/C:N/I:P/A:N
- cvss_version: NOT_EXTRACTED -> 2.0
- data_sources: ['cve'] -> ['cve', 'nvd']