ProjectForge Multiple HTML Injection and Cross Site Request Forgery Vulnerabilities
BID:64632
Info
ProjectForge Multiple HTML Injection and Cross Site Request Forgery Vulnerabilities
| Bugtraq ID: | 64632 |
| Class: | Input Validation Error |
| CVE: |
CVE-2013-7250 CVE-2013-7251 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 30 2013 12:00AM |
| Updated: | Jan 09 2014 12:40AM |
| Credit: | Sergej Michel and Peter Baus, Micromata. |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
ProjectForge Multiple HTML Injection and Cross Site Request Forgery Vulnerabilities
ProjectForge is prone to an multiple HTML-injection and cross-site request-forgery vulnerabilities.
Exploiting these issues may allow a remote attacker to perform certain unauthorized actions, execute arbitrary script or HTML code within the context of the browser, and steal cookie-based authentication credentials. Other attacks are also possible.
ProjectForge 5.2 is vulnerable; other version may also be affected.
ProjectForge is prone to an multiple HTML-injection and cross-site request-forgery vulnerabilities.
Exploiting these issues may allow a remote attacker to perform certain unauthorized actions, execute arbitrary script or HTML code within the context of the browser, and steal cookie-based authentication credentials. Other attacks are also possible.
ProjectForge 5.2 is vulnerable; other version may also be affected.
Exploit / POC
ProjectForge Multiple HTML Injection and Cross Site Request Forgery Vulnerabilities
An attacker can exploit HTML-injection issues through a browser.
To exploit the cross-site request-forgery issues, the attacker must entice an unsuspecting victim into visiting a malicious site.
An attacker can exploit HTML-injection issues through a browser.
To exploit the cross-site request-forgery issues, the attacker must entice an unsuspecting victim into visiting a malicious site.
Solution / Fix
ProjectForge Multiple HTML Injection and Cross Site Request Forgery Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
ProjectForge Multiple HTML Injection and Cross Site Request Forgery Vulnerabilities
References:
References: