WackoWiki Multiple Unspecified Cross-Site Scripting Vulnerabilities
BID:11935
Info
WackoWiki Multiple Unspecified Cross-Site Scripting Vulnerabilities
| Bugtraq ID: | 11935 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 28 2003 12:00AM |
| Updated: | Jun 28 2003 12:00AM |
| Credit: | This vulnerability was reported by the vendor. |
| Vulnerable: |
WackoWiki WackoWiki R3 WackoWiki WackoWiki R2 |
| Not Vulnerable: |
WackoWiki WackoWiki R3.5 |
Discussion
WackoWiki Multiple Unspecified Cross-Site Scripting Vulnerabilities
It is reported that WackoWiki is affected by multiple unspecified cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input.
These issues could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.
The vendor has not released specific details about these vulnerabilities, stating only that multiple cross-site scripting vulnerabilities have been addressed with the release of WackoWiki R3.5.
It is reported that WackoWiki is affected by multiple unspecified cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input.
These issues could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.
The vendor has not released specific details about these vulnerabilities, stating only that multiple cross-site scripting vulnerabilities have been addressed with the release of WackoWiki R3.5.
Exploit / POC
WackoWiki Multiple Unspecified Cross-Site Scripting Vulnerabilities
No exploit is required.
No exploit is required.
Solution / Fix
WackoWiki Multiple Unspecified Cross-Site Scripting Vulnerabilities
Solution:
The vendor has addressed this issue in WackoWiki R3.5 and later.
WackoWiki WackoWiki R2
WackoWiki WackoWiki R3
Solution:
The vendor has addressed this issue in WackoWiki R3.5 and later.
WackoWiki WackoWiki R2
-
WackoWiki WackoWiki R4
http://wackowiki.com/WackoDownload/InEnglish
WackoWiki WackoWiki R3
-
WackoWiki WackoWiki R4
http://wackowiki.com/WackoDownload/InEnglish
References
WackoWiki Multiple Unspecified Cross-Site Scripting Vulnerabilities
References:
References:
- WackoWiki Release Notes (WackoWiki)