Unscored CVE-2005-2204 EUVD-2005-2205GHSA-j4px-gj2f-8656

Cross-site scripting (XSS) vulnerability in Computer Associates (CA) eTrust SiteMinder 5.5, when the "CSSChecking" parameter is set to "NO,…

Published Jul 11, 2005 · Updated Aug 7, 2024 · Assigned by mitre

Description

Cross-site scripting (XSS) vulnerability in Computer Associates (CA) eTrust SiteMinder 5.5, when the "CSSChecking" parameter is set to "NO," allows remote attackers to inject arbitrary web script or HTML via the (1) PASSWORD or (2) BUFFER parameters to smpwservicescgi.exe, (3) the TARGET parameter to login.fcc, and possibly other vectors.

References

1014433 vdb-entry
15956 third-party-advisory
17809 vdb-entry
ca-siteminder-smpwservicescgi-xss(21305) vdb-entry
17810 vdb-entry
20050711 Re: SiteMinder Multiple Vulnerabilities mailing-list
20050708 SiteMinder Multiple Vulnerabilities mailing-list
ADV-2005-1040 vdb-entry