full-disclosure - CVE-2013-5966 - XSS in ZK Framework

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <5285CECD.1010808@csnc.ch>
Date: Fri, 15 Nov 2013 08:35:41 +0100
From: Stephan Rickauer <stephan.rickauer@...c.ch>
To: vuln@...unia.com, full-disclosure@...ts.grok.org.uk
Subject: CVE-2013-5966 - XSS in ZK Framework

#####################################################################
#
# COMPASS SECURITY ADVISORY  - http://www.csnc.ch/
#
#####################################################################
#
# CVE ID : CVE-2013-5966
# CSNC ID: CSNC-2013-023
# Product: ZK Framework
# Vendor:  Potix Corporation
# Subject: Cross-site Scripting - XSS
# Risk:    High
# Effect:  Remotely exploitable
# Author:  Stephan Rickauer (stephan.rickauer@...c.ch)
# Date:    November 15th 2013
#
#####################################################################


Introduction:
-------------
Compass Security AG discovered a security flaws in the ZK
Java Framework.


Vulnerable:
-----------
- ZK Framework versions prior version 5.0.13


Patches:
--------
Version 5.0.13 has this issue fixed.


Description:
------------
The ZK Framework does not properly encode output of user data
in certain places. Exploiting this vulnerability leads to so-called
cross-site scripting (XSS) and allows execution of JavaScript code in
the context of the user's session, e.g. to impersonate logged-in ZK
Framework users.


Milestones:
-----------
2013-09-11  Vulnerability discovered
2013-09-27  Acknowledgement of vulnerability by vendor
2013-09-27  Release of ZK patch
2013-09-30  CVE-ID requested and assigned by MITRE
2013-10-08  Public availability of patched ZK release 5.0.13
2013-11-15  Public release of this advisory


References:
-----------
http://www.zkoss.org/product/zk
https://github.com/zkoss/zk/blob/v5.0.13/zkdoc/release-note
ZK internal identifier: ZK-1961

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/