ViewVC Cross Site Scripting and Unspecified Security Vulnerabilities
BID:36035
Info
ViewVC Cross Site Scripting and Unspecified Security Vulnerabilities
| Bugtraq ID: | 36035 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 12 2009 12:00AM |
| Updated: | Aug 21 2009 06:43PM |
| Credit: | Red Hat |
| Vulnerable: |
ViewVC ViewVC 1.0.8 ViewVC ViewVC 1.0.5 ViewVC ViewVC 1.0.3 ViewVC ViewVC 1.0.2 Red Hat Fedora 11 Red Hat Fedora 10 |
| Not Vulnerable: |
ViewVC ViewVC 1.0.9 |
Discussion
ViewVC Cross Site Scripting and Unspecified Security Vulnerabilities
ViewVC is prone to these security vulnerabilities:
- A cross-site scripting vulnerability.
- An unspecified security vulnerability that may allow attackers to print illegal parameter names and values.
An attacker may leverage theses issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and steal cookie-based authentication credentials. Other attacks are also possible.
Versions prior to ViewVC 1.0.9 are vulnerable.
ViewVC is prone to these security vulnerabilities:
- A cross-site scripting vulnerability.
- An unspecified security vulnerability that may allow attackers to print illegal parameter names and values.
An attacker may leverage theses issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and steal cookie-based authentication credentials. Other attacks are also possible.
Versions prior to ViewVC 1.0.9 are vulnerable.
Exploit / POC
ViewVC Cross Site Scripting and Unspecified Security Vulnerabilities
An attacker can exploit these issues through a browser, To exploit a cross-site scripting vulnerability, the attacker can exploit these issues by enticing an unsuspecting victim to follow a malicious URI.
An attacker can exploit these issues through a browser, To exploit a cross-site scripting vulnerability, the attacker can exploit these issues by enticing an unsuspecting victim to follow a malicious URI.
Solution / Fix
ViewVC Cross Site Scripting and Unspecified Security Vulnerabilities
Solution:
Vendor updates are available. Please see the references for details.
Solution:
Vendor updates are available. Please see the references for details.
References
ViewVC Cross Site Scripting and Unspecified Security Vulnerabilities
References:
References:
- ViewVC Changelog (ViewVC)
- ViewVC Tigris Homepage (ViewVC)