TI-2008-03554 Aliases CVE-2008-3712 GHSA-4cj8-p6h5-47jq

Multiple cross-site scripting (XSS) vulnerabilities in Mambo 4.6.2 and 4.6.5, when…

LOW 17CWE-79Published 2008-08-19 · Updated 2024-08-07

Key facts

Attack vector: Network
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: High
Impact type: Cross-site scripting
Confidentiality · integrity · availability: None · Partial · None
Fix status: No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Multiple cross-site scripting (XSS) vulnerabilities in Mambo 4.6.2 and 4.6.5, when register_globals is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) query string to mambots/editors/mostlyce/jscripts/tiny_mce/filemanager/connectors/php/connector.php and the (2) mosConfig_sitename parameter to administrator/popups/index3pop.php.

Why it matters now

EPSS 0.01877 79th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:mambo:mambo:4.6.2:::::::*	4.6.2	Vulnerable	Mambo
cpe:2.3:a:mambo:mambo:4.6.5:::::::*	4.6.5	Vulnerable	Mambo

cpe:2.3:a:mambo:mambo:4.6.2:*:*:*:*:*:*:* Versions 4.6.2 Vulnerable ·Mambo
cpe:2.3:a:mambo:mambo:4.6.5:*:*:*:*:*:*:* Versions 4.6.5 Vulnerable ·Mambo

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2008-3712
2026-10-03 Alias added: GHSA-4cj8-p6h5-47jq

References

Advisory 1

4164

TI-2007-05150 Multiple PHP remote file inclusion vulnerabilities in the Avant-Garde Solutions MOSMedia… CVSS 2.0MEDIUM 6.8
TI-2008-02779 PHP remote file inclusion vulnerability in includes/Cache/Lite/Output.php in the… CVSS 2.0MEDIUM 6.8
TI-2006-01740 SQL injection vulnerability in Mambo 4.5.3, 4.5.3h, and possibly earlier versions allows… CVSS 2.0HIGH 7.6
TI-2006-03161 SQL injection vulnerability in the Weblinks module (weblinks.php) in Mambo 4.6rc1 and… CVSS 2.0HIGH 7.5
TI-2004-01569 PHP remote file inclusion vulnerability in Function.php in Mambo 4.5 (1.0.9) allows… CVSS 2.0HIGH 7.5
TI-2007-04316 SQL injection vulnerability in index.php in the SimpleFAQ (com_simplefaq) 2.11 component… CVSS 2.0HIGH 7.5

See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences