Vulnerability Description
Multiple cross-site scripting (XSS) vulnerabilities in phpLDAPadmin 0.9.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dn parameter in (a) compare_form.php, (b) copy_form.php, (c) rename_form.php, (d) template_engine.php, and (e) delete_form.php; (2) scope parameter in (f) search.php; and (3) Container DN, (4) Machine Name, and (5) UID Number fields in (g) template_engine.php.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Phpldapadmin Project | Phpldapadmin | <= 0.9.8 |
| Debian | Debian Linux | 3.0 |
Related Weaknesses (CWE)
References
- http://pridels0.blogspot.com/2006/04/phpldapadmin-multiple-vuln.htmlThird Party Advisory
- http://secunia.com/advisories/19747ExploitThird Party Advisory
- http://secunia.com/advisories/20124Third Party Advisory
- http://www.debian.org/security/2006/dsa-1057Third Party Advisory
- http://www.osvdb.org/24788Broken LinkExploit
- http://www.osvdb.org/24789Broken LinkExploit
- http://www.osvdb.org/24790Broken LinkExploit
- http://www.osvdb.org/24792Broken LinkExploit
- http://www.osvdb.org/24793Broken LinkExploit
- http://www.osvdb.org/24794Broken LinkExploit
- http://www.securityfocus.com/bid/17643ExploitThird Party AdvisoryVDB Entry
- http://www.vupen.com/english/advisories/2006/1450Permissions Required
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25958Third Party AdvisoryVDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25959Third Party AdvisoryVDB Entry
- http://pridels0.blogspot.com/2006/04/phpldapadmin-multiple-vuln.htmlThird Party Advisory
FAQ
What is CVE-2006-2016?
CVE-2006-2016 is a vulnerability with a CVSS score of 2.6 (LOW). Multiple cross-site scripting (XSS) vulnerabilities in phpLDAPadmin 0.9.8 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dn parameter in (a) compare_form.php, (b...
How severe is CVE-2006-2016?
CVE-2006-2016 has been rated LOW with a CVSS base score of 2.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2006-2016?
Check the references section above for vendor advisories and patch information. Affected products include: Phpldapadmin Project Phpldapadmin, Debian Debian Linux.