full-disclosure - [SECURITY] CVE-2011-1077: Apache Archiva Multiple XSS vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <BANLkTi=pm+vTHqKwp9fBt8fLnYqkmP_D4w@mail.gmail.com>
Date: Fri, 27 May 2011 20:24:11 +0800
From: Deng Ching <oching@...che.org>
To: announce@...che.org, bugtraq@...urityfocus.com, security@...che.org, 
	full-disclosure@...ts.grok.org.uk, users@...hiva.apache.org, 
	dev@...hiva.apache.org
Subject: [SECURITY] CVE-2011-1077: Apache Archiva Multiple
	XSS vulnerability

CVE-2011-1077: Apache Archiva Multiple XSS vulnerability

Severity: High

Vendor:
The Apache Software Foundation

Versions Affected:
Archiva 1.3.0 - 1.3.4
The unsupported versions Archiva 1.0 - 1.2.2 are also affected.

Description:
The multiple XSS issues found are both Stored (Persistent) and
Reflected (Non-Persistent). Javascript which might contain malicious
code can be appended in a request parameter or stored as a value in a
submitted form, and get executed.

Mitigation:
Archiva 1.3.4 and earlier users should upgrade to 1.3.5

Credit:
This issue was discovered by Riyaz Ahemed Walikar of Microland Ltd., India

References:
http://archiva.apache.org/security.html

Thanks,
The Apache Archiva Team

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/