HTML Purifier ConfigForm.PHP Cross-Site Scripting Vulnerability

Bugtraq ID:	24699
Class:	Input Validation Error
CVE:	CVE-2007-3498
Remote:	Yes
Local:	No
Published:	Jun 28 2007 12:00AM
Updated:	May 07 2015 05:37PM
Credit:	The vendor reported this vulnerability.
Vulnerable:	Edward Z. Yang HTML Purifier 2.0
Not Vulnerable:	Edward Z. Yang HTML Purifier 2.0.1

HTML Purifier ConfigForm.PHP Cross-Site Scripting Vulnerability

HTML Purifier is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Versions prior to HTML Purifier 2.0.1 are affected.

HTML Purifier ConfigForm.PHP Cross-Site Scripting Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

HTML Purifier ConfigForm.PHP Cross-Site Scripting Vulnerability

Solution:
The vendor has released fixes to address this issue; please see the reference section for details.


Edward Z. Yang HTML Purifier 2.0

• Edward Z. Yang htmlpurifier-2.0.1.tar.gz
  http://freshmeat.net/redir/htmlpurifier/65948/url_tgz/htmlpurifier-2.0 .1.tar.gz

HTML Purifier ConfigForm.PHP Cross-Site Scripting Vulnerability

References:

• HTML Purifier Web Site (Edward Z. Yang)