lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20041124030002.9537.qmail@www.securityfocus.com> Date: 24 Nov 2004 03:00:02 -0000 From: <advisory@...security.com> To: bugtraq@...urityfocus.com Subject: STG Security Advisory: [SSA-20041122-11] JSPWiki XSS vulnerability STG Security Advisory: [SSA-20041122-11] JSPWiki XSS vulnerability Revision 1.0 Date Published: 2004-11-22 (KST) Last Update: 2004-11-22 Disclosed by SSR Team (advisory@...security.com) Summary ======== JSPWiki is one of famous wiki web applications. It has a cross site scripting vulnerability. Vulnerability Class =================== Implementation Error: Input validation flaw Details ======= Due to an input validation flaw, the JSPWiki is vulnerable to cross site scripting attacks. http://[victim]/Search.jsp?query=<script>alert('hi')</script> Impact ====== Medium: Malicious attackers can inject and execute arbitrary script code in a user's browser session in context of an affected site. Workaround ========== There is no known workaround at this time. Affected Products ================ JSPWiki v2.1.120-cvs and prior Vendor Status: NOT FIXED ======================= 2004-10-01 Vulnerability found. 2004-10-27 JSPWiki developer notified. 2004-11-22 Official release. Credits ====== Jeremy Bae at STG Security
Powered by blists - more mailing lists