XHProf 'run' Parameter Cross Site Scripting Vulnerability
BID:62928
Info
XHProf 'run' Parameter Cross Site Scripting Vulnerability
| Bugtraq ID: | 62928 |
| Class: | Input Validation Error |
| CVE: |
CVE-2013-4433 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 02 2013 12:00AM |
| Updated: | May 07 2015 05:07PM |
| Credit: | The vendor reported this issue. |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
XHProf 'run' Parameter Cross Site Scripting Vulnerability
XHProf is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.
Attackers can exploit this issue to steal cookie-based authentication information, execute arbitrary client-side scripts in the context of the browser, and obtain sensitive information. Other attacks are also possible.
XHProf versions 0.9.3 and prior are vulnerable.
XHProf is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.
Attackers can exploit this issue to steal cookie-based authentication information, execute arbitrary client-side scripts in the context of the browser, and obtain sensitive information. Other attacks are also possible.
XHProf versions 0.9.3 and prior are vulnerable.
Exploit / POC
XHProf 'run' Parameter Cross Site Scripting Vulnerability
To exploit a cross-site scripting vulnerability, an attacker must entice an unsuspecting user to follow a malicious URI.
To exploit a cross-site scripting vulnerability, an attacker must entice an unsuspecting user to follow a malicious URI.
Solution / Fix
XHProf 'run' Parameter Cross Site Scripting Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
XHProf 'run' Parameter Cross Site Scripting Vulnerability
References:
References:
- Changelog for xhprof 0.9.4 (xhprof)
- xhprof HomePage (xhprof)