TCLHttpd Multiple Cross-Site Scripting Vulnerabilities
BID:8688
Info
TCLHttpd Multiple Cross-Site Scripting Vulnerabilities
| Bugtraq ID: | 8688 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 24 2003 12:00AM |
| Updated: | Sep 24 2003 12:00AM |
| Credit: | Phuong Nguyen <[email protected]> |
| Vulnerable: |
TCLHttpd TCLHttpd 3.4.2 |
| Not Vulnerable: | |
Discussion
TCLHttpd Multiple Cross-Site Scripting Vulnerabilities
It has been reported that several of the modules included with TCLHTtpd are vulnerable to cross-site scripting attacks. According to the report, the Status, Debug, Mail and Admin modules are affected by these vulnerabilities. Four instances of this vulnerability have been pointed out, all appearing to be in the Debug module. These vulnerabilities may allow an attacker to execute script code in the context of another client session. Cookie theft and content modification attacks are possible.
The discoverer of this vulnerability has stated that version 3.4.2 is affected. It is likely that prior versions are also vulnerable.
It has been reported that several of the modules included with TCLHTtpd are vulnerable to cross-site scripting attacks. According to the report, the Status, Debug, Mail and Admin modules are affected by these vulnerabilities. Four instances of this vulnerability have been pointed out, all appearing to be in the Debug module. These vulnerabilities may allow an attacker to execute script code in the context of another client session. Cookie theft and content modification attacks are possible.
The discoverer of this vulnerability has stated that version 3.4.2 is affected. It is likely that prior versions are also vulnerable.
Solution / Fix
TCLHttpd Multiple Cross-Site Scripting Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.