full-disclosure - CVE-2013-1413

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <51305D50.8040201@csnc.ch>
Date: Fri, 01 Mar 2013 08:48:32 +0100
From: Stephan Rickauer <stephan.rickauer@...c.ch>
To: full-disclosure@...ts.grok.org.uk, vuln@...unia.com
Subject: CVE-2013-1413

#############################################################
#
# COMPASS SECURITY ADVISORY http://www.csnc.ch/
#
#############################################################
#
# CVE ID : CVE-2013-1413
# CSNC ID: CSNC-2013-003
# Product: i-doit
# Vendor:  synetics Gesellschaft für Systemintegration mbH
# Subject: Cross-site Scripting - XSS
# Risk:    High
# Effect:  Remotely exploitable
# Author:  Stephan Rickauer (stephan.rickauer@...c.ch)
# Date:    March 1st 2013
#
#############################################################


Introduction:
-------------
Compass Security AG discovered multiple security flaws in the i-doit
CMDB web application.


Vulnerable:
-----------
- i-doit version prior to 1.0 Pro and 0.9.9-7 Open
- i-doit version after 1.0 Pro with disabled input filter (by default)


Patches:
--------
Version 1.0.2 Pro has received a new configure option to 'sanitize user
input' which defaults to off and has to be manually enabled.


Description:
------------
The i-doit web application does not properly encode output of user data
in various places. Exploiting this vulnerability leads to so-called
cross-site scripting (XSS) and allows execution of JavaScript code in
the context of the user's session, e.g. to impersonate logged-in i-doit
CMDB users.


Milestones:
-----------
2013-01-20  Vulnerability discovered
2013-01-20  Vendor notified
2013-01-20  CVE requested at MITRE.org
2013-01-21  Vendor contact established, provided with technical details
2013-01-21  CVE-ID assigned by MITRE
2013-01-21  Acknowledgement of vulnerability by vendor and agreement of
             advisory release schedule
2013-01-28  More XSS vulnerabilites identified, vendor updated
2013-02-20  Release of patched vendor software
2013-03-01  Public release of advisory


References:
-----------
http://www.i-doit.org
http://www.i-doit.com
http://www.csnc.ch

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/