TikiWiki Unspecified Cross-Site Scripting Vulnerability
BID:15164
Info
TikiWiki Unspecified Cross-Site Scripting Vulnerability
| Bugtraq ID: | 15164 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 21 2005 12:00AM |
| Updated: | Oct 21 2005 12:00AM |
| Credit: | The vendor disclosed this vulnerability. |
| Vulnerable: |
TikiWiki Project TikiWiki 1.9.1 TikiWiki Project TikiWiki 1.8.5 Gentoo Linux |
| Not Vulnerable: |
TikiWiki Project TikiWiki 1.9.1 .1 |
Discussion
TikiWiki Unspecified Cross-Site Scripting Vulnerability
TikiWiki is prone to an unspecified cross-site scripting vulnerability. This is due to a lack of proper sanitization of user-supplied input.
An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
TikiWiki is prone to an unspecified cross-site scripting vulnerability. This is due to a lack of proper sanitization of user-supplied input.
An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
Exploit / POC
TikiWiki Unspecified Cross-Site Scripting Vulnerability
No exploit is required.
No exploit is required.
Solution / Fix
TikiWiki Unspecified Cross-Site Scripting Vulnerability
Solution:
Gentoo has released advisory GLSA 200510-23 and fixes to address this issue. To obtain fixes, execute the following:
emerge --sync
emerge --ask --oneshot --verbose ">=www-apps/tikiwiki-1.9.1.1"
The vendor has released version 1.9.1.1 to address this issue.
TikiWiki Project TikiWiki 1.8.5
TikiWiki Project TikiWiki 1.9.1
Solution:
Gentoo has released advisory GLSA 200510-23 and fixes to address this issue. To obtain fixes, execute the following:
emerge --sync
emerge --ask --oneshot --verbose ">=www-apps/tikiwiki-1.9.1.1"
The vendor has released version 1.9.1.1 to address this issue.
TikiWiki Project TikiWiki 1.8.5
-
Tikiwiki Project tikiwiki-1.9.1.1.tar.gz
http://prdownloads.sourceforge.net/tikiwiki/tikiwiki-1.9.1.1.tar.gz
TikiWiki Project TikiWiki 1.9.1
-
Tikiwiki Project tikiwiki-1.9.1.1.tar.gz
http://prdownloads.sourceforge.net/tikiwiki/tikiwiki-1.9.1.1.tar.gz
References
TikiWiki Unspecified Cross-Site Scripting Vulnerability
References:
References:
- TikiWiki Change Log (TikiWiki )
- TikiWiki Homepage (TikiWiki Project)