GeSHi 'langwiz.php' Cross Site Scripting Vulnerability

Bugtraq ID:	59830
Class:	Input Validation Error
CVE:	CVE-2012-3522
Remote:	Yes
Local:	No
Published:	Jun 23 2012 12:00AM
Updated:	May 07 2015 05:16PM
Credit:	Benny Baumann
Vulnerable:	GeSHi GeSHi 1.0.8.4
Not Vulnerable:	GeSHi GeSHi 1.0.8.11

GeSHi 'langwiz.php' Cross Site Scripting Vulnerability

GeSHi is prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

GeSHi 1.0.8.4 is vulnerable; other versions may also be affected.

Note: This issue was previously covered in BID 55124 (GeSHi Multiple Local File Include and Cross Site Scripting Vulnerabilities), but has been given its own record for better documentation.

GeSHi 'langwiz.php' Cross Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.

GeSHi 'langwiz.php' Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

GeSHi 'langwiz.php' Cross Site Scripting Vulnerability

References:

• GeSHi Homepage (GeSHi)
  
• GeSHi Release Notes Web Page (GeSHi)