Omeka HTML Injection and Cross Site Request Forgery Vulnerabilities

Bugtraq ID:	68707
Class:	Input Validation Error
CVE:	CVE-2014-5100
Remote:	Yes
Local:	No
Published:	Jul 17 2014 12:00AM
Updated:	Aug 01 2014 12:29AM
Credit:	Gjoko Krstic
Vulnerable:
Not Vulnerable:

Omeka HTML Injection and Cross Site Request Forgery Vulnerabilities

Omeka is prone to an HTML-injection vulnerability and a cross-site request-forgery vulnerability.

Exploiting these issues may allow a remote attacker to perform certain unauthorized actions, execute arbitrary script or HTML code within the context of the browser, and steal cookie-based authentication credentials. Other attacks are also possible.

Omeka 2.2 is vulnerable; other version may also be affected.

Omeka HTML Injection and Cross Site Request Forgery Vulnerabilities

An attacker can exploit HTML-injection issue through a browser. To exploit the cross-site request-forgery issue, the attacker must entice an unsuspecting victim into visiting a malicious site.

The following proof-of-concept is available:

• /data/vulnerabilities/exploits/68707.txt

Omeka HTML Injection and Cross Site Request Forgery Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Omeka HTML Injection and Cross Site Request Forgery Vulnerabilities

References: