Mojolicious 'link_to helper' HTML Injection Vulnerability

Bugtraq ID:	47713
Class:	Input Validation Error
CVE:	CVE-2011-1841
Remote:	Yes
Local:	No
Published:	May 04 2011 12:00AM
Updated:	Apr 13 2015 09:32PM
Credit:	Reported by the vendor
Vulnerable:	Mojolicious Mojolicious 1.11 Mojolicious Mojolicious 1.10 Mojolicious Mojolicious 1.09 Mojolicious Mojolicious 0.999928 Mojolicious Mojolicious 0.999927 Mojolicious Mojolicious 0.999926 Mojolicious Mojolicious 0.991250 Mojolicious Mojolicious 0.991246 Mojolicious Mojolicious 0.991245 Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0
Not Vulnerable:	Mojolicious Mojolicious 1.12

Mojolicious 'link_to helper' HTML Injection Vulnerability

Mojolicious is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, or launch other attacks.

Mojolicious prior to version 1.12 are vulnerable.

Mojolicious 'link_to helper' HTML Injection Vulnerability

An attacker can exploit this issue through a browser.

Mojolicious 'link_to helper' HTML Injection Vulnerability

Solution:
Updates are available. Please see the references for more information.

Mojolicious 'link_to helper' HTML Injection Vulnerability

References:

• Mojolicious 1.20 Release Notes (Mojolicious)
  
• Mojolicious Homepage (Mojolicious)