[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Swiki 1.5 Multiple Cross-Site Scripting Vulnerabilities
- To: bugtraq@xxxxxxxxxxxxxxxxx
- Subject: Swiki 1.5 Multiple Cross-Site Scripting Vulnerabilities
- From: brad.antoniewicz@xxxxxxxxxxxxxx
- Date: 7 Apr 2008 23:27:55 -0000
Title: Swiki 1.5 Multiple Cross-Site Scripting Vulnerabilities
Vendor URL: http://wiki.squeak.org/swiki Vendor Contacted: Yes
Description:
Multiple stored and reflective cross-site scripting vulnerabilities were
identified in Swiki 1.5.
Reflective (example):
http://[host]:8000/<script>alert("XSS");</script>
Stored (example):
On posts to 1.append when adding new entries into the wiki, the application
does not properly escape javascript code resulting in a stored cross-site
scripting attack.
Credit:
Brad Antoniewicz
brad.antoniewicz@xxxxxxxxxxxxxx