[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Full-Disclosure] STG Security Advisory: [SSA-20041122-12] Zwiki XSS vulnerability
- To: <vuln@xxxxxxxxxxx>, <news@xxxxxxxxxxxxxx>, <bugs@xxxxxxxxxxxxxxxxxxx>, <full-disclosure@xxxxxxxxxxxxxxxx>, <staff@xxxxxxxxxxxxxxxxxxxxxxx>
- Subject: [Full-Disclosure] STG Security Advisory: [SSA-20041122-12] Zwiki XSS vulnerability
- From: "SSR Team" <advisory@xxxxxxxxxxxxxxx>
- Date: Wed, 24 Nov 2004 11:58:19 +0900
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
STG Security Advisory: [SSA-20041122-12] Zwiki XSS vulnerability
Revision 1.1
Date Published: 2004-11-22 (KST)
Last Update: 2004-11-22
Disclosed by SSR Team (advisory@xxxxxxxxxxxxxxx)
Summary
========
Zwiki is a wiki clone in zope. It has a cross site scripting vulnerability.
Vulnerability Class
===================
Implementation Error: Input validation flaw
Details
=======
Due to an input validation flaw, the Zwiki is vulnerable to cross site
scripting attacks.
cf. http://zwiki.org/925ZwikiXSSVulnerability
proof of concept
http://[victim]/<img src=javascript:alert('hi')>
Impact
======
Medium: Malicious attackers can inject and execute arbitrary script code in
a user's browser session in context of an affected site.
Workaround
==========
There is no known workaround at this time.
Affected Products
================
Zwiki 0.36.2 and prior
Vendor Status: NOT FIXED
=======================
2004-10-01 Vulnerability found.
2004-10-01 Zwiki developer notified.
2004-11-22 Official release.
Credits
======
Jeremy Bae at STG Security
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0
iQA/AwUBQaP4tT9dVHd/hpsuEQJBogCg3Nbwv9aZ2ZDmQS4z17f2w8ogGukAnAoD
Gbj1Yf87gJVSiLb+g/ky60tJ
=ppK5
-----END PGP SIGNATURE-----
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html