CVE-2008-1183

Multiple cross-site scripting (XSS) vulnerabilities in Crafty Syntax Live Help (CSLH) before 2.14.6 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) livehelp.php, (2) user_questions.php, and (3) leavemessage.php. NOTE: the lostsheep.php vector is covered by CVE-2008-0848.

Published: Mar 6, 2008
Updated: Apr 13, 2023
CVE: CVE-2008-1183
Severity: Low
Exploit:

CVSS v2:

Severity: Low
Score: 4.3
AV:N/AC:M/Au:N/C:N/I:P/A:N

CWEs:

CWE-79

OWASP TOP 10:

A7 - Cross-Site Scripting (XSS)

Affected Software
References

Software	From	Fixed in
crafty_syntax_live_help / crafty_syntax_live_help	2.4.15	2.4.15.x
crafty_syntax_live_help / crafty_syntax_live_help	2.4.14	2.4.14.x
crafty_syntax_live_help / crafty_syntax_live_help	2.4.13	2.4.13.x

http://secunia.com/advisories/29201
http://sourceforge.net/project/shownotes.php?release_id=580994
http://www.securityfocus.com/bid/28071
https://exchange.xforce.ibmcloud.com/vulnerabilities/40636

Vulnerability Database

290,020

CVE-2008-1183