{"api_version":"1","generated_at":"2026-07-23T04:33:54+00:00","cve":"CVE-2005-3971","urls":{"html":"https://cve.report/CVE-2005-3971","api":"https://cve.report/api/cve/CVE-2005-3971.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2005-3971","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2005-3971"},"summary":{"title":"CVE-2005-3971","description":"Cross-site scripting (XSS) vulnerability in the login form in Citrix MetaFrame Secure Access Manager 2.0 through 2.2 and NFuse Elite 1.0 allows remote attackers to inject arbitrary web script or HTML via the username field.","state":"PUBLISHED","assigner":"mitre","published_at":"2005-12-03 19:03:00","updated_at":"2025-04-03 01:03:51"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://securitytracker.com/id?1015304","name":"http://securitytracker.com/id?1015304","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityTracker.com Archives - Citrix MetaFrame Secure Access Manager Input Validation Flaw in Login Pages Permits Cross-Site Scripting Attacks","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://support.citrix.com/article/CTX108208","name":"http://support.citrix.com/article/CTX108208","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"404 - Page not found","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"http://www.vupen.com/english/advisories/2005/2676","name":"http://www.vupen.com/english/advisories/2005/2676","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/23396","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/23396","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/17819","name":"http://secunia.com/advisories/17819","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"Citrix Products Login Page Cross-Site Scripting Vulnerability - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://securitytracker.com/id?1015305","name":"http://securitytracker.com/id?1015305","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityTracker.com Archives - Citrix NFuse Elite Input Validation Flaw in Login Pages Permits Cross-Site Scripting Attacks","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/15664","name":"http://www.securityfocus.com/bid/15664","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"Citrix Multiple Applications Login Form Cross-Site Scripting Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2005-3971","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2005-3971","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2005","cve_id":"3971","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"citrix","cpe5":"metaframe_secure_access_manager","cpe6":"2.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2005","cve_id":"3971","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"citrix","cpe5":"metaframe_secure_access_manager","cpe6":"2.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2005","cve_id":"3971","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"citrix","cpe5":"metaframe_secure_access_manager","cpe6":"2.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2005","cve_id":"3971","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"citrix","cpe5":"nfuse","cpe6":"1.0","cpe7":"*","cpe8":"elite","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T23:31:48.974Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"1015305","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://securitytracker.com/id?1015305"},{"name":"1015304","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://securitytracker.com/id?1015304"},{"name":"15664","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/15664"},{"name":"ADV-2005-2676","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2005/2676"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://support.citrix.com/article/CTX108208"},{"name":"citrix-login-xss(23396)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/23396"},{"name":"17819","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/17819"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2005-11-29T00:00:00.000Z","descriptions":[{"lang":"en","value":"Cross-site scripting (XSS) vulnerability in the login form in Citrix MetaFrame Secure Access Manager 2.0 through 2.2 and NFuse Elite 1.0 allows remote attackers to inject arbitrary web script or HTML via the username field."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-07-19T15:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"1015305","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://securitytracker.com/id?1015305"},{"name":"1015304","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://securitytracker.com/id?1015304"},{"name":"15664","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/15664"},{"name":"ADV-2005-2676","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2005/2676"},{"tags":["x_refsource_CONFIRM"],"url":"http://support.citrix.com/article/CTX108208"},{"name":"citrix-login-xss(23396)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/23396"},{"name":"17819","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/17819"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2005-3971","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Cross-site scripting (XSS) vulnerability in the login form in Citrix MetaFrame Secure Access Manager 2.0 through 2.2 and NFuse Elite 1.0 allows remote attackers to inject arbitrary web script or HTML via the username field."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"1015305","refsource":"SECTRACK","url":"http://securitytracker.com/id?1015305"},{"name":"1015304","refsource":"SECTRACK","url":"http://securitytracker.com/id?1015304"},{"name":"15664","refsource":"BID","url":"http://www.securityfocus.com/bid/15664"},{"name":"ADV-2005-2676","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2005/2676"},{"name":"http://support.citrix.com/article/CTX108208","refsource":"CONFIRM","url":"http://support.citrix.com/article/CTX108208"},{"name":"citrix-login-xss(23396)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/23396"},{"name":"17819","refsource":"SECUNIA","url":"http://secunia.com/advisories/17819"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2005-3971","datePublished":"2005-12-03T19:00:00.000Z","dateReserved":"2005-12-03T00:00:00.000Z","dateUpdated":"2024-08-07T23:31:48.974Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2005-12-03 19:03:00","lastModifiedDate":"2025-04-03 01:03:51","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:citrix:metaframe_secure_access_manager:2.0:*:*:*:*:*:*:*","matchCriteriaId":"02CEEF28-CB2C-47A4-A0F1-B6AB9C8A132B"},{"vulnerable":true,"criteria":"cpe:2.3:a:citrix:metaframe_secure_access_manager:2.1:*:*:*:*:*:*:*","matchCriteriaId":"D5123FE8-FA68-4844-8F70-ED1F5C1086E0"},{"vulnerable":true,"criteria":"cpe:2.3:a:citrix:metaframe_secure_access_manager:2.2:*:*:*:*:*:*:*","matchCriteriaId":"5F6523EC-2F19-4C9C-9139-483DDCC1667E"},{"vulnerable":true,"criteria":"cpe:2.3:a:citrix:nfuse:1.0:*:elite:*:*:*:*:*","matchCriteriaId":"27E22341-F1AD-4551-8EA6-7106FA590A21"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2005","CveId":"3971","Ordinal":"1","Title":"CVE-2005-3971","CVE":"CVE-2005-3971","Year":"2005"},"notes":[{"CveYear":"2005","CveId":"3971","Ordinal":"1","NoteData":"Cross-site scripting (XSS) vulnerability in the login form in Citrix MetaFrame Secure Access Manager 2.0 through 2.2 and NFuse Elite 1.0 allows remote attackers to inject arbitrary web script or HTML via the username field.","Type":"Description","Title":"CVE-2005-3971"},{"CveYear":"2005","CveId":"3971","Ordinal":"2","NoteData":"2005-12-03","Type":"Other","Title":"Published"},{"CveYear":"2005","CveId":"3971","Ordinal":"3","NoteData":"2017-07-19","Type":"Other","Title":"Modified"}]}}}