ViewVC UTF-7 Charset Unspecified HTML Injection Vulnerability

Bugtraq ID:	20543
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 16 2006 12:00AM
Updated:	Oct 16 2006 10:04PM
Credit:	Stefan Esser is credited with the discovery of this vulnerability.
Vulnerable:	ViewVC ViewVC 1.0.2
Not Vulnerable:

ViewVC UTF-7 Charset Unspecified HTML Injection Vulnerability

ViewVC is prone to a HTML-injection vulnerability because of it fails to specify a charset in the HTML body or the HTTP header.

Exploiting this issue could allow an attacker to execute attacker-supplied script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

ViewVC 1.0.2 and prior versions are vulnerable; other versions may also be affected.

ViewVC UTF-7 Charset Unspecified HTML Injection Vulnerability

Attackers can exploit this issue via a web client.

ViewVC UTF-7 Charset Unspecified HTML Injection Vulnerability

Solution:
The vendor released version 1.0.3 to address this issue. Please see the references for more information.


ViewVC ViewVC 1.0.2

• ViewVC ViewVC 1.0.3
  http://viewvc.tigris.org/servlets/ProjectDocumentList?folderID=6004

ViewVC UTF-7 Charset Unspecified HTML Injection Vulnerability

References:

• Advisory 10/2006: ViewVC Undefined Charset UTF-7 XSS Vulnerability (Stefan Esser)