Vanilla Forums CVE-2011-0526 Cross-Site Scripting Vulnerability

Bugtraq ID:	73593
Class:	Input Validation Error
CVE:	CVE-2011-0526
Remote:	Yes
Local:	No
Published:	Feb 08 2011 12:00AM
Updated:	Feb 08 2011 12:00AM
Credit:	Unknown
Vulnerable:	Vanillaforums Vanilla Forums 2.0.9 Vanillaforums Vanilla Forums 2.0.16 Vanillaforums Vanilla Forums 2.0.15 Vanillaforums Vanilla Forums 2.0.14 Vanillaforums Vanilla Forums 2.0.13 Vanillaforums Vanilla Forums 2.0.12 Vanillaforums Vanilla Forums 2.0.11 Vanillaforums Vanilla Forums 2.0.10
Not Vulnerable:

Vanilla Forums CVE-2011-0526 Cross-Site Scripting Vulnerability

Vanilla Forums is prone to a cross-site scripting vulnerability. Cross-site scripting (XSS) vulnerability in index.php in Vanilla Forums before 2.0.17 allows remote attackers to inject arbitrary web script or HTML via the Target parameter in a /entry/signin action.

Vanilla Forums CVE-2011-0526 Cross-Site Scripting Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or you are aware of more recent information, please mail us at: [email protected]

Vanilla Forums CVE-2011-0526 Cross-Site Scripting Vulnerability

References:

• http://yehg.net/lab/pr0js/advisories/%5Bvanilla_forums-2.0.16%5D_cross_site_scri (MISC)
  
• oss-security - CVE Request:Vanilla Forums 2.0.16 <= Cross Site Scripting Vulnera (MLIST)
  
• oss-security - Re: CVE Request:Vanilla Forums 2.0.16 <= Cross Site Scripting V (MLIST)
  
• Vanilla 2.0.17 Released (Vanilla Forums)