dotProject Unspecified Cross-Site Scripting Vulnerability

Bugtraq ID:	18275
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 05 2006 12:00AM
Updated:	Jun 05 2006 10:47PM
Credit:	The vendor disclosed this issue.
Vulnerable:	Dotproject Dotproject 2.0.1
Not Vulnerable:	Dotproject Dotproject 2.0.3

dotProject Unspecified Cross-Site Scripting Vulnerability

dotProject is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

dotProject Unspecified Cross-Site Scripting Vulnerability

This issue can be exploited through a web client.

dotProject Unspecified Cross-Site Scripting Vulnerability

Solution:
The vendor has released version 2.0.3 to address this [email protected]


Dotproject Dotproject 2.0.1

• Dotproject dotproject-2.0.3.tar.gz
  http://prdownloads.sourceforge.net/dotproject/dotproject-2.0.3.tar.gz

dotProject Unspecified Cross-Site Scripting Vulnerability

References:

• dotProject Web Site (dotProject)
  
• Release Name: dotProject Version 2.0.3 (dotProject)