XWiki Enterprise Unspecified SQL Injection and Cross Site Scripting Vulnerabilities
BID:44601
Info
XWiki Enterprise Unspecified SQL Injection and Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 44601 |
| Class: | Input Validation Error |
| CVE: |
CVE-2010-4641 CVE-2010-4642 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 02 2010 12:00AM |
| Updated: | Apr 13 2015 09:02PM |
| Credit: | Reported by the vendor. |
| Vulnerable: |
XWiki XWiki 1.1 RC2 XWiki XWiki 1.1 RC1 XWiki XWiki 1.1 |
| Not Vulnerable: |
XWiki XWiki Enterprise 2.5 |
Discussion
XWiki Enterprise Unspecified SQL Injection and Cross Site Scripting Vulnerabilities
XWiki Enterprise is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Versions prior to XWiki Enterprise 2.5 are affected.
XWiki Enterprise is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Versions prior to XWiki Enterprise 2.5 are affected.
Exploit / POC
XWiki Enterprise Unspecified SQL Injection and Cross Site Scripting Vulnerabilities
Attackers can use a browser to exploit these issues. To exploit the cross-site scripting issue, an attacker must entice an unsuspecting user into following a malicious URI.
Attackers can use a browser to exploit these issues. To exploit the cross-site scripting issue, an attacker must entice an unsuspecting user into following a malicious URI.
Solution / Fix
XWiki Enterprise Unspecified SQL Injection and Cross Site Scripting Vulnerabilities
Solution:
The vendor has released fixes. Please see the references for details.
Solution:
The vendor has released fixes. Please see the references for details.
References
XWiki Enterprise Unspecified SQL Injection and Cross Site Scripting Vulnerabilities
References:
References:
- XWiki Enterprise Homepage (XWiki)
- Security improvements (XWiki )