Blosxom 'blosxom.cgi' Cross-Site Scripting Vulnerability

Bugtraq ID:	31535
Class:	Input Validation Error
CVE:	CVE-2008-2236
Remote:	Yes
Local:	No
Published:	Oct 02 2008 12:00AM
Updated:	Oct 02 2008 09:28PM
Credit:	Yoshinori Ohta of Business Architects
Vulnerable:	Blosxom Blosxom 2.0 Blosxom Blosxom 2.1
Not Vulnerable:	Blosxom Blosxom 2.1.2

Blosxom 'blosxom.cgi' Cross-Site Scripting Vulnerability

Blosxom is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Versions prior to Blosxom 2.1.2 are affected.

Blosxom 'blosxom.cgi' Cross-Site Scripting Vulnerability

To exploit this issue, an attacker must entice an unsuspecting user to follow a malicious URI.

Blosxom 'blosxom.cgi' Cross-Site Scripting Vulnerability

Solution:
The vendor has released Blosxom 2.1.2 to address this issue. Please see the references for more information.


Blosxom Blosxom 2.1

• Blosxom blosxom-2.1.2.tar.gz
  http://sourceforge.net/project/platformdownload.php?group_id=148044

Blosxom Blosxom 2.0

• Blosxom blosxom-2.1.2.tar.gz
  http://sourceforge.net/project/platformdownload.php?group_id=148044

Blosxom 'blosxom.cgi' Cross-Site Scripting Vulnerability

References:

• Blosxom 2.1.2 Changelog (Blosxom)
  
• Blosxom Homepage (Blosxom)