bugtraq - Re: XSS vulnerability in Lantern CMS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <alpine.LNX.2.00.1012161823200.10111@forced.attrition.org>
Date: Thu, 16 Dec 2010 18:25:33 -0600 (CST)
From: security curmudgeon <jericho@...rition.org>
To: advisory@...ridge.ch
Cc: bugtraq@...urityfocus.com
Subject: Re: XSS vulnerability in Lantern CMS


: Vulnerability ID: HTB22620
: Reference: http://www.htbridge.ch/advisory/xss_vulnerability_in_lantern_cms.html
: Product: Lantern CMS
: Vendor: Lantern ( http://www.lanterncms.com/www/html/7-home-page.asp ) 
: Vulnerable Version: Current at 18.09.2010 and Probably Prior Versions

>From the vendor page:

2 September: Lantern Release 3.2.2 Lantern 3.2.2 provides for enhanced 
digital asset management capability 


So did you test 3.2.2, or is there a reason you opted not to include the 
version information, such as you testing their site instead of an actual 
installation?