CGI RESCUE Trees Cross Site Scripting Vulnerability

Bugtraq ID:	34999
Class:	Input Validation Error
CVE:	CVE-2009-1790
Remote:	Yes
Local:	No
Published:	May 18 2009 12:00AM
Updated:	Apr 13 2015 09:10PM
Credit:	JVN
Vulnerable:	CGI RESCUE Trees 2.10
Not Vulnerable:	CGI RESCUE Trees 2.11

CGI RESCUE Trees Cross Site Scripting Vulnerability

Trees is prone to a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Versions prior to Trees 2.11 are vulnerable.

CGI RESCUE Trees Cross Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.

CGI RESCUE Trees Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references for details.


CGI RESCUE Trees 2.10

• CGI RESCUE trees2.11.zip
  http://www.rescue.ne.jp/cgi/trees/trees2.11.zip

CGI RESCUE Trees Cross Site Scripting Vulnerability

References:

• Electronic bulletin board thread ceremony Trees security fix (v2.11) (CGI RESCUE)
  
• JVN#28521500 CGI RESCUE Trees (JVN)