Foswiki CVE-2012-1004 Cross-Site Scripting Vulnerability

Bugtraq ID:	73554
Class:	Input Validation Error
CVE:	CVE-2012-1004
Remote:	Yes
Local:	No
Published:	Feb 07 2012 12:00AM
Updated:	Feb 07 2012 12:00AM
Credit:	Unknown
Vulnerable:
Not Vulnerable:

Foswiki CVE-2012-1004 Cross-Site Scripting Vulnerability

Foswiki is prone to a cross-site scripting vulnerability. Multiple cross-site scripting (XSS) vulnerabilities in UI/Register.pm in Foswiki before 1.1.5 allow remote authenticated users with CHANGE privileges to inject arbitrary web script or HTML via the (1) text, (2) FirstName, (3) LastName, (4) OrganisationName, (5) OrganisationUrl, (6) Profession, (7) Country, (8) State, (9) Address, (10) Location, (11) Telephone, (12) VoIP, (13) InstantMessagingIM, (14) Email, (15) HomePage, or (16) Comment parameter. NOTE: some of these details are obtained from third party information.

Foswiki CVE-2012-1004 Cross-Site Scripting Vulnerability

An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.

Foswiki CVE-2012-1004 Cross-Site Scripting Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or you are aware of more recent information, please mail us at: [email protected]

Foswiki CVE-2012-1004 Cross-Site Scripting Vulnerability

References:

• Item11498: Implement a new whitelist mechanism to help sanitize the script zone (Foswiki)
  
• Item11501: User registration needs mechanism to validate form fields < Tasks < F (CONFIRM)
  
• Security Alert: Foswiki Script Insertion Vulnerability via unchecked user regist (Foswiki)
  
• st2tea: Foswiki Cross Site Scripting (MISC)