RETIRED: Tiki Wiki CMS Groupware CVE-2013-4714 Unspecified Cross Site Scripting Vulnerability
BID:63574
Info
RETIRED: Tiki Wiki CMS Groupware CVE-2013-4714 Unspecified Cross Site Scripting Vulnerability
| Bugtraq ID: | 63574 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 05 2013 12:00AM |
| Updated: | Nov 07 2013 01:42PM |
| Credit: | Yuji Tounai of bogus.jp. |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
RETIRED: Tiki Wiki CMS Groupware CVE-2013-4714 Unspecified Cross Site Scripting Vulnerability
Tiki Wiki CMS Groupware is prone to an unspecified cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
Versions prior to Tiki Wiki CMS Groupware 11.1, 10.4, 9.7 LTS, and 6.13 LTS are vulnerable.
Note: This BID is being retired as a duplicate of the issue discussed in BID 63462 (Tiki Wiki CMS Groupware Unspecified SQL Injection and Cross Site Scripting Vulnerabilities)
Tiki Wiki CMS Groupware is prone to an unspecified cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
Versions prior to Tiki Wiki CMS Groupware 11.1, 10.4, 9.7 LTS, and 6.13 LTS are vulnerable.
Note: This BID is being retired as a duplicate of the issue discussed in BID 63462 (Tiki Wiki CMS Groupware Unspecified SQL Injection and Cross Site Scripting Vulnerabilities)
Exploit / POC
RETIRED: Tiki Wiki CMS Groupware CVE-2013-4714 Unspecified Cross Site Scripting Vulnerability
An attacker must trick an unsuspecting victim into following a malicious URI to exploit this issue.
An attacker must trick an unsuspecting victim into following a malicious URI to exploit this issue.
Solution / Fix
RETIRED: Tiki Wiki CMS Groupware CVE-2013-4714 Unspecified Cross Site Scripting Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
RETIRED: Tiki Wiki CMS Groupware CVE-2013-4714 Unspecified Cross Site Scripting Vulnerability
References:
References:
- Tiki Wiki CMS Groupware Homepage (Tiki Wiki CMS Groupware)