Cross Site Scripting (XSS) in Owl <=0.95, CVE-2008-3100

2008.07.31
Risk: Low
Local: No
Remote: Yes
CWE: CWE-79


CVSS Base Score: 4.3/10
Impact Subscore: 2.9/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: None
Integrity impact: Partial
Availability impact: None

Cross Site Scripting (XSS) in Owl <=0.95, CVE-2008-3100 References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3100 http://owl.sourceforge.net/ http://www.datensalat.eu/~fabian/cve/CVE-2008-3100-Owl.html Description: Owl is a multi user document repository (knowledgebase) system for publishing files/documents onto the web. The application is vulnerable to simple Cross Site Scripting, which can be used for several isues Example: Assuming Owl is installed on http://localhost/Owl/, one can inject JavaScript with: http://localhost/Owl/register.php?myaction=getpasswd&username="><script> alert(1);</script> Workaround/Fix: Replace your owl.lib.php with the version from http://owl.cvs.sourceforge.net/*checkout*/owl/owl-0.90/lib/owl.lib.php Disclosure Timeline: 2008-07-27 Vendor contacted 2008-07-28 Vendor: fixed issue in cvs / no need for new stable release 2008-07-28 Advisory published CVE Information: The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2008-3100 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org/), which standardizes names for security problems. Credits and copyright: This vulnerability was discovered by Fabian Fingerle (published with help from Hanno Boeck (http://www.hboeck.de)). It's licensed under the creative commons attribution license 3.0. Fabian Fingerle, 2008-07-28, http://www.fabian-fingerle.de -- _GPG_ 3D17 CAC8 1955 1908 65ED 5C51 FDA3 6A09 AB41 AB85 _chaos events near stuttgart_ www.datensalat.eu -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (GNU/Linux) iEYEARECAAYFAkiONwAACgkQ/aNqCatBq4XKOwCguF+SspGgfQG8FNRWLOHSDRLT 9ugAoI6E1/WPAePKhMwlBgIlDXmfJmWI =gwZX -----END PGP SIGNATURE-----

References:

http://www.securityfocus.com/bid/30410
http://www.datensalat.eu/~fabian/cve/CVE-2008-3100-Owl.html
http://www.securityfocus.com/archive/1/archive/1/494843/100/0/threaded
http://www.frsirt.com/english/advisories/2008/2209


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2017, cxsecurity.com

 

Back to Top