Doxygen CVE-2016-10245 Cross Site Scripting Vulnerability

Bugtraq ID:	108476
Class:	Input Validation Error
CVE:	CVE-2016-10245
Remote:	Yes
Local:	No
Published:	May 24 2019 12:00AM
Updated:	May 24 2019 12:00AM
Credit:	bjonkman.nrel
Vulnerable:	Doxygen Doxygen 1.8.11 Doxygen Doxygen 1.8 Doxygen Doxygen 1.7 Doxygen Doxygen 1.6 Doxygen Doxygen 1.5 Doxygen Doxygen 1.4 Doxygen Doxygen 1.3 Doxygen Doxygen 1.2 Doxygen Doxygen 1.1
Not Vulnerable:	Doxygen Doxygen 1.8.12

Doxygen CVE-2016-10245 Cross Site Scripting Vulnerability

Doxygen is prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Versions prior to Doxygen 1.8.12 are vulnerable.

Doxygen CVE-2016-10245 Cross Site Scripting Vulnerability

To exploit this issue an attacker must entice an unsuspecting victim to open a malicious URI.

Doxygen CVE-2016-10245 Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Doxygen CVE-2016-10245 Cross Site Scripting Vulnerability

References:

• Bug 762934 - External search does not properly escape user supplied (Github)
  
• Doxygen Homepage (Doxygen)
  
• Bug 1714190 CVE-2016-10245 doxygen: cross-site scripting (Redhat)
  
• Bug 762934 - External search does not properly escape user supplied data (Gnome)
  
• CVE-2016-10245 (Redhat)