CVE-2005-1909 Cross-site scripting in n/a

Q: Is CVE-2005-1909 being exploited?

There is no known exploitation of CVE-2005-1909 in the wild and no public exploit code.

Q: How do I fix CVE-2005-1909?

No fix has been published for CVE-2005-1909 yet. Limit exposure of the affected software until one is available.

Medium 4.3 Published 8 Jun 2005 Updated 16 Sep 2024

Remote attackers can inject HTML sequences into log files via HTTP requests, obscuring logs from administrators in the 602LAN SUITE web control panel.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2005-1909?

CVE-2005-1909 is a medium-severity cross-site scripting vulnerability in n/a, published on 8 Jun 2005. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The web server control panel in 602LAN SUITE 2004 allows remote attackers to make it more difficult for the administrator to read portions of log files via a "</pre><!-" sequence in an HTTP GET request in the logon, possibly due to a cross-site scripting (XSS) vulnerability.

Which versions are affected by CVE-2005-1909?

It affects 1 product.

Products include Software602 602lan Suite.

How do I fix CVE-2005-1909?

No fix has been published for CVE-2005-1909 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2005-1909 being exploited?

There is no known exploitation of CVE-2005-1909 in the wild and no public exploit code.

Sources

Also known as GHSA-m757-m826-j8h2.