TWiki URLPARAM Variable Cross Site Scripting Vulnerability
BID:32669
Info
TWiki URLPARAM Variable Cross Site Scripting Vulnerability
| Bugtraq ID: | 32669 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-5304 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 06 2008 12:00AM |
| Updated: | Dec 11 2008 03:31AM |
| Credit: | Marc Schoenefeld and Steve Milner of Red Hat Security Response Team |
| Vulnerable: |
TWiki TWiki 4.2.3 TWiki TWiki 4.2.2 TWiki TWiki 4.2.1 TWiki TWiki 4.2 TWiki TWiki 4.1.2 TWiki TWiki 4.1.1 TWiki TWiki 4.1 TWiki TWiki 4.0.5 TWiki TWiki 4.0.4 TWiki TWiki 4.0.3 TWiki TWiki 4.0.2 TWiki TWiki 4.0.1 TWiki TWiki 0 |
| Not Vulnerable: |
TWiki TWiki 4.2.4 |
Discussion
TWiki URLPARAM Variable Cross Site Scripting Vulnerability
TWiki is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
TWiki is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
Exploit / POC
TWiki URLPARAM Variable Cross Site Scripting Vulnerability
To exploit this issue, an attacker must entice an unsuspecting victim into following a malicious URI.
The following example is available:
To exploit this issue, an attacker must entice an unsuspecting victim into following a malicious URI.
The following example is available:
Solution / Fix
TWiki URLPARAM Variable Cross Site Scripting Vulnerability
Solution:
The vendor has released an advisory and fixes to address this issue; please see the references for more information.
Solution:
The vendor has released an advisory and fixes to address this issue; please see the references for more information.
References
TWiki URLPARAM Variable Cross Site Scripting Vulnerability
References:
References: