lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20041124030025.9587.qmail@www.securityfocus.com> Date: 24 Nov 2004 03:00:25 -0000 From: <advisory@...security.com> To: bugtraq@...urityfocus.com Subject: STG Security Advisory: [SSA-20041122-12] Zwiki XSS vulnerability STG Security Advisory: [SSA-20041122-12] Zwiki XSS vulnerability Revision 1.1 Date Published: 2004-11-22 (KST) Last Update: 2004-11-22 Disclosed by SSR Team (advisory@...security.com) Summary ======== Zwiki is a wiki clone in zope. It has a cross site scripting vulnerability. Vulnerability Class =================== Implementation Error: Input validation flaw Details ======= Due to an input validation flaw, the Zwiki is vulnerable to cross site scripting attacks. cf. http://zwiki.org/925ZwikiXSSVulnerability proof of concept http://[victim]/<img src=javascript:alert('hi')> Impact ====== Medium: Malicious attackers can inject and execute arbitrary script code in a user's browser session in context of an affected site. Workaround ========== There is no known workaround at this time. Affected Products ================ Zwiki 0.36.2 and prior Vendor Status: NOT FIXED ======================= 2004-10-01 Vulnerability found. 2004-10-01 Zwiki developer notified. 2004-11-22 Official release. Credits ====== Jeremy Bae at STG Security
Powered by blists - more mailing lists