Bug: Apache Continuum cross-site scripting vulnerability (WLB-2011020159 Ascii Version)

English Version
WLB2

CVE WLB2

WLB2
Full List
Bugs
Bogus
Tricks
Exploits
CVE MAP
Full List
Vendors
Products
Tools
CWE Dictionary
Google Hacking
Search
General
CVE
CWE
RSS
Full List
Bugs
Exploits
Dorks
Information
Our services
Add note
About
Submit

To add a note,

use this form

or send email to

submit@cxsecurity.com

When contacting via email, we recommend coded messages.

Get our PGP public key

 Topic: Apache Continuum cross-site scripting vulnerability
 Credit: Tal Be'ery
 Date: 2011.02.21
 CWE: CWE-79 (Show similar)
 CVE: CVE-2011-0533 (Show details)

Use CVE to see details like:
- CVSS2,
- Affected Software,
- References

Risk
Local
Remote
Low
No
Yes

CVE-2011-0533: Apache Continuum cross-site scripting vulnerability

Severity: Important

Vendor:
The Apache Software Foundation

Versions Affected:
Continuum 1.3.6
Continuum 1.4.0 (Beta)
The unsupported versions Continuum 1.1 - 1.2.3.1 are also affected.

Description:
A request that included a specially crafted request parameter could be
used to inject arbitrary HTML or Javascript into Continuum project
pages.

Mitigation:
Continuum 1.3.6 and earlier users should upgrade to 1.3.7

Continuum 1.4.0 (Beta) users should apply the following patch:
http://svn.apache.org/viewvc?view=revision&revision=1066056

Credit:
This issue was discovered by Tal Be'ery of Imperva.

References:
http://continuum.apache.org/security.html

--
Brett Porter
brett (at) apache (dot) org [email concealed]
http://brettporter.wordpress.com/
http://au.linkedin.com/in/brettporter

References:

http://svn.apache.org/viewvc?view=revision&revision=1066056
http://svn.apache.org/viewvc?view=revision&revision=1066053
http://seclists.org/fulldisclosure/2011/Feb/236
http://xforce.iss.net/xforce/xfdb/65343
http://www.vupen.com/english/advisories/2011/0373
http://www.securityfocus.com/bid/46311
http://www.securityfocus.com/archive/1/archive/1/516342/100/0/threaded
http://securitytracker.com/id?1025065
http://secunia.com/advisories/43261
http://mail-archives.apache.org/mod_mbox/continuum-users/201102.mbox/%3C981C0A79-5B7B-4053-84CC-3217870BE360@apache.org%3E
http://jira.codehaus.org/browse/CONTINUUM-2604
http://continuum.apache.org/security.html

[ ASCII VERSION ]
Copyright 2012, cxsecurity.com