Transmission Multiple HTML Injection Vulnerabilities

Bugtraq ID:	54705
Class:	Input Validation Error
CVE:	CVE-2012-4037
Remote:	Yes
Local:	No
Published:	Jul 27 2012 12:00AM
Updated:	Sep 26 2012 03:30PM
Credit:	Justin C. Klein Keane
Vulnerable:	Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Transmission Project Transmission 1.9.2 Transmission Project Transmission 1.9.1 Transmission Project Transmission 1.92 Transmission Project Transmission 1.91 Transmission Project Transmission 1.77 Transmission Project Transmission 1.76 Transmission Project Transmission 1.50 Transmission Project Transmission 1.41
Not Vulnerable:

Transmission Multiple HTML Injection Vulnerabilities

Transmission is prone to multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input data.

Exploiting these issues may allow an attacker to execute HTML and script code in the context of the affected site, to steal cookie-based authentication credentials, or to control how the site is rendered to the user; other attacks are also possible.

Transmission versions prior to 2.61 are vulnerable.

Transmission Multiple HTML Injection Vulnerabilities

Attackers can use a browser to exploit these issues.

Transmission Multiple HTML Injection Vulnerabilities

Solution:
Vendor updates are available. Please see the references for more information

Transmission Multiple HTML Injection Vulnerabilities

References:

• Transmission Homepage (Transmission Project )