FKIE_CVE-2013-6808

Vulnerability from fkie_nvd - Published: 2013-12-28 04:53 - Updated: 2025-04-11 00:51
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in lib/NSSDropoff.php in ZendTo before 4.11-13 allows remote attackers to inject arbitrary web script or HTML via a modified emailAddr field to pickup.php.
References
cve@mitre.orghttp://www.zend.to/changelog.php
cve@mitre.orghttps://www.packetlabs.net/cve-2013-6808/Exploit
af854a3a-2127-422b-91ae-364da2661108http://www.zend.to/changelog.php
af854a3a-2127-422b-91ae-364da2661108https://www.packetlabs.net/cve-2013-6808/Exploit
Impacted products
Vendor Product Version
zend zendto *
zend zendto 4.00
zend zendto 4.01
zend zendto 4.02
zend zendto 4.03-3
zend zendto 4.05-2
zend zendto 4.06-2
zend zendto 4.07-1
zend zendto 4.08-4
zend zendto 4.09-1
zend zendto 4.10-4
zend zendto 4.10-5
zend zendto 4.11-1
zend zendto 4.11-2
zend zendto 4.11-3
zend zendto 4.11-4
zend zendto 4.11-5
zend zendto 4.11-7
zend zendto 4.11-8
zend zendto 4.11-9
zend zendto 4.11-10
zend zendto 4.11-11
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:zend:zendto:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9E53876E-C0FC-4211-8AEC-3FE1575EC11B",
              "versionEndIncluding": "4.11-12",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zend:zendto:4.00:*:*:*:*:*:*:*",
              "matchCriteriaId": "E92086FD-7FE7-46E2-9430-87C78A0268AC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zend:zendto:4.01:*:*:*:*:*:*:*",
              "matchCriteriaId": "2D84A13A-C889-4083-8441-1FE743847A3D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zend:zendto:4.02:*:*:*:*:*:*:*",
              "matchCriteriaId": "8DB3EF67-4D08-4DDC-B601-5D9F00464694",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zend:zendto:4.03-3:*:*:*:*:*:*:*",
              "matchCriteriaId": "006D7A44-8573-4FF6-BBE7-8C9518E143CD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zend:zendto:4.05-2:*:*:*:*:*:*:*",
              "matchCriteriaId": "CA6D16A1-2481-4B47-A0FC-2FCF3153E47C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zend:zendto:4.06-2:*:*:*:*:*:*:*",
              "matchCriteriaId": "5381907E-1341-4884-BC66-40ACEEC8B101",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zend:zendto:4.07-1:*:*:*:*:*:*:*",
              "matchCriteriaId": "ABE0C7E6-B806-48E3-9F81-17A0929A4B0F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zend:zendto:4.08-4:*:*:*:*:*:*:*",
              "matchCriteriaId": "F58C02DF-F24C-46CC-A096-57A24446EB31",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zend:zendto:4.09-1:*:*:*:*:*:*:*",
              "matchCriteriaId": "E025DC7D-5BF2-4B8D-97E3-6017C53FD82F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zend:zendto:4.10-4:*:*:*:*:*:*:*",
              "matchCriteriaId": "91377F42-3AE7-465C-AF97-13F5E3062A9C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zend:zendto:4.10-5:*:*:*:*:*:*:*",
              "matchCriteriaId": "9D84D638-9921-45CD-961E-3DBC20516767",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zend:zendto:4.11-1:*:*:*:*:*:*:*",
              "matchCriteriaId": "9BB5D444-17B1-4A66-AC98-9C9A85355310",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zend:zendto:4.11-2:*:*:*:*:*:*:*",
              "matchCriteriaId": "C5F369D9-56FB-41F1-8D45-3565EBA98FF6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zend:zendto:4.11-3:*:*:*:*:*:*:*",
              "matchCriteriaId": "97AAD0F3-C54A-4DFB-9C72-BACE392AB30B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zend:zendto:4.11-4:*:*:*:*:*:*:*",
              "matchCriteriaId": "289CB602-06A2-4DF7-B9DC-BAFD7FC1FEA7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zend:zendto:4.11-5:*:*:*:*:*:*:*",
              "matchCriteriaId": "81C93EF8-1189-49E9-AB98-58BA79E04F6E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zend:zendto:4.11-7:*:*:*:*:*:*:*",
              "matchCriteriaId": "56B8A398-4A25-4C5B-95C8-7EE48FE72406",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zend:zendto:4.11-8:*:*:*:*:*:*:*",
              "matchCriteriaId": "5E93F880-9636-4D19-9EF9-D24EF990635D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zend:zendto:4.11-9:*:*:*:*:*:*:*",
              "matchCriteriaId": "674611D3-EAB1-45AC-BD2A-890BDE07A57E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zend:zendto:4.11-10:*:*:*:*:*:*:*",
              "matchCriteriaId": "1620FA37-B729-43E5-B9C8-3D958EA09FC0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zend:zendto:4.11-11:*:*:*:*:*:*:*",
              "matchCriteriaId": "0D94AE99-BBA4-47CA-973D-FB1DEE759ACB",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in lib/NSSDropoff.php in ZendTo before 4.11-13 allows remote attackers to inject arbitrary web script or HTML via a modified emailAddr field to pickup.php."
    },
    {
      "lang": "es",
      "value": "Cross-site scripting (XSS) en lib / NSSDropoff.php en ZendTo anterior a  4,11-13, permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s de un campo emailAddr modificado en pickup.php."
    }
  ],
  "id": "CVE-2013-6808",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2013-12-28T04:53:06.617",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://www.zend.to/changelog.php"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "https://www.packetlabs.net/cve-2013-6808/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.zend.to/changelog.php"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "https://www.packetlabs.net/cve-2013-6808/"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.