Mail.ru Calendar Plugin For JIRA CVE-2016-10716 HTML Injection Vulnerability
BID:103470
Info
Mail.ru Calendar Plugin For JIRA CVE-2016-10716 HTML Injection Vulnerability
| Bugtraq ID: | 103470 |
| Class: | Input Validation Error |
| CVE: |
CVE-2016-10716 |
| Remote: | Yes |
| Local: | No |
| Published: | May 13 2016 12:00AM |
| Updated: | May 13 2016 12:00AM |
| Credit: | Omkar Joshi |
| Vulnerable: |
Atlassian Mail.Ru Calendar Plugin 2.4.3.51 Atlassian Mail.Ru Calendar Plugin 2.4.2.50 |
| Not Vulnerable: |
Atlassian Mail.Ru Calendar Plugin 2.5.0.61 |
Discussion
Mail.ru Calendar Plugin For JIRA CVE-2016-10716 HTML Injection Vulnerability
Mail.ru Calendar For JIRA is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.
Versions prior to Mail.ru Calendar Plugin 2.5.0.61 are vulnerable.
Mail.ru Calendar For JIRA is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.
Versions prior to Mail.ru Calendar Plugin 2.5.0.61 are vulnerable.
References
Mail.ru Calendar Plugin For JIRA CVE-2016-10716 HTML Injection Vulnerability
References:
References:
- Atlassian Homepage (Atlassian)
- Mail.Ru Calendar Version history (Atlassian)
- Mail.Ru Calendar Plugin Homepage (Atlassian)