WoltLab Burning Board WCF Cross Site Scripting And Information Disclosure Vulnerabilities
BID:28678
Info
WoltLab Burning Board WCF Cross Site Scripting And Information Disclosure Vulnerabilities
| Bugtraq ID: | 28678 |
| Class: | Unknown |
| CVE: |
CVE-2008-1717 CVE-2008-1716 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 08 2008 12:00AM |
| Updated: | Jul 05 2016 10:01PM |
| Credit: | Jessica Hope |
| Vulnerable: |
Woltlab Community Framework 1.0.6 |
| Not Vulnerable: | |
Discussion
WoltLab Burning Board WCF Cross Site Scripting And Information Disclosure Vulnerabilities
WoltLab Community Framework (WCF) included in Burning Board is prone to multiple cross-site scripting and information-disclosure vulnerabilities because it fails to properly handle exceptional conditions and sanitize user-supplied input.
An attacker may leverage these issues to obtain potentially sensitive information and to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
These issues affect WCF 1.0.6 included in Burning Board 3.0.5; other versions may also be vulnerable.
UPDATE (April 12, 2008): A recent Bugtraq message indicates that the cross-site scripting issues may have been fixed in WCF 1.0.6. This information conflicts with the original report and has not been confirmed. Please see the references for more information.
WoltLab Community Framework (WCF) included in Burning Board is prone to multiple cross-site scripting and information-disclosure vulnerabilities because it fails to properly handle exceptional conditions and sanitize user-supplied input.
An attacker may leverage these issues to obtain potentially sensitive information and to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
These issues affect WCF 1.0.6 included in Burning Board 3.0.5; other versions may also be vulnerable.
UPDATE (April 12, 2008): A recent Bugtraq message indicates that the cross-site scripting issues may have been fixed in WCF 1.0.6. This information conflicts with the original report and has not been confirmed. Please see the references for more information.
Exploit / POC
WoltLab Burning Board WCF Cross Site Scripting And Information Disclosure Vulnerabilities
Attackers can exploit the information-disclosure issues through a browser. To exploit the cross-site scripting issues, the attacker must entice unsuspecting users to follow a malicious URI.
Attackers can exploit the information-disclosure issues through a browser. To exploit the cross-site scripting issues, the attacker must entice unsuspecting users to follow a malicious URI.
Solution / Fix
WoltLab Burning Board WCF Cross Site Scripting And Information Disclosure Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
WoltLab Burning Board WCF Cross Site Scripting And Information Disclosure Vulnerabilities
References:
References: