Cloisterblog Multiple Unspecified Cross-Site Scripting Vulnerabilities

Bugtraq ID:	9996
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 29 2004 12:00AM
Updated:	Mar 29 2004 12:00AM
Credit:	Discovery of these issues is credited to Dotho <[email protected]>.
Vulnerable:	Cloisterblog Cloisterblog 1.2.2
Not Vulnerable:

Cloisterblog Multiple Unspecified Cross-Site Scripting Vulnerabilities

Multiple unspecified cross-site scripting vulnerabilities have been reported in Cloisterblog. These issues could permit theft of cookie-based authentication credentials or other attacks.

This is due to insufficient sanitization of URI parameters, whose input will be included in dynamically generated web pages.

An attacker could exploit these issues by enticing a victim user to follow a malicious link to a vulnerable site.

Cloisterblog Multiple Unspecified Cross-Site Scripting Vulnerabilities

There is no exploit required.

Cloisterblog Multiple Unspecified Cross-Site Scripting Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Cloisterblog Multiple Unspecified Cross-Site Scripting Vulnerabilities

References:

• CloisterBlog Homepage (Stephen Kozik )
  
• Multiple Vulnerabilities in Cloisterblog web blog/journal (Dotho )