Bugtraq mailing list archives
STG Security Advisory: [SSA-20041122-12] Zwiki XSS vulnerability
From: <advisory () stgsecurity com>
Date: 24 Nov 2004 03:00:25 -0000
STG Security Advisory: [SSA-20041122-12] Zwiki XSS vulnerability Revision 1.1 Date Published: 2004-11-22 (KST) Last Update: 2004-11-22 Disclosed by SSR Team (advisory () stgsecurity com) Summary ======== Zwiki is a wiki clone in zope. It has a cross site scripting vulnerability. Vulnerability Class =================== Implementation Error: Input validation flaw Details ======= Due to an input validation flaw, the Zwiki is vulnerable to cross site scripting attacks. cf. http://zwiki.org/925ZwikiXSSVulnerability proof of concept http://[victim]/<img src=javascript:alert('hi')> Impact ====== Medium: Malicious attackers can inject and execute arbitrary script code in a user's browser session in context of an affected site. Workaround ========== There is no known workaround at this time. Affected Products ================ Zwiki 0.36.2 and prior Vendor Status: NOT FIXED ======================= 2004-10-01 Vulnerability found. 2004-10-01 Zwiki developer notified. 2004-11-22 Official release. Credits ====== Jeremy Bae at STG Security
Current thread:
- STG Security Advisory: [SSA-20041122-12] Zwiki XSS vulnerability advisory (Nov 25)
- Re: STG Security Advisory: [SSA-20041122-12] Zwiki XSS vulnerability Chris Withers (Nov 27)