EZ Publish Logging HTML Injection Vulnerability

Bugtraq ID:	7138
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 18 2003 12:00AM
Updated:	Mar 18 2003 12:00AM
Credit:	Discovery is credited to Ertan Kurt <[email protected]>.
Vulnerable:	eZ Systems eZ publish 2.2.7
Not Vulnerable:

EZ Publish Logging HTML Injection Vulnerability

eZ publish may allow malicious HTML and script code contained in requests to be logged. When an administrative user views this information through eZ publish, the hostile HTML and script code could be interpreted in their browser. This could allow for compromise of cookie-based credentials or other possible attacks.

This issue was reported in eZ publish 2.2.7. Other versions may also be affected.

EZ Publish Logging HTML Injection Vulnerability

There is no exploit required.

EZ Publish Logging HTML Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

EZ Publish Logging HTML Injection Vulnerability

References:

• eZ Publish Homepage (eZ Publish)
  
• Some XSS vulns (Ertan Kurt )