oss-sec mailing list archives
Re: Re: CVE request: XSS in PNP4Nagios
From: Salvatore Bonaccorso <carnil () debian org>
Date: Fri, 11 Jul 2014 10:19:00 +0200
Hi, On Fri, Jul 11, 2014 at 03:11:22AM -0400, cve-assign () mitre org wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1Jun 04, 2014 This issue was detected by Peter Osterberg https://github.com/lingej/pnp4nagios/commits/master/share/pnp/application/views/kohana_error_page.php https://github.com/lingej/pnp4nagios/commit/f846a6c9d007ca2bee05359af747619151195fc9 http://sourceforge.net/p/pnp4nagios/code/ci/f846a6c9d007ca2bee05359af747619151195fc9- <p><?php echo $message ?></p> + <p><?php echo html::specialchars($message) ?></p>Use CVE-2014-4907.Jun 13, 2014 pnp/views/kohana_error_page: plug another XSS hole https://github.com/lingej/pnp4nagios/commits/master/share/pnp/application/views/kohana_error_page.php https://github.com/lingej/pnp4nagios/commit/e4a19768a5c5e5b1276caf3dd5bb721a540ec014Jun 13, 2014 Plug potential XSS hole in views/template.php https://github.com/lingej/pnp4nagios/commits/master/share/pnp/application/views/template.php https://github.com/lingej/pnp4nagios/commit/cb925073edeeb97eb4ce61a86cdafccc9b87f9bbUse CVE-2014-4908 for both e4a19768a5c5e5b1276caf3dd5bb721a540ec014 and cb925073edeeb97eb4ce61a86cdafccc9b87f9bb. These are both <meta http-equiv="refresh" content="[INSERT_NUMBER_HERE]; url=<?php echo $_SERVER['REQUEST_URI'] ?>"> issues. We realize that it is possible that e4a19768a5c5e5b1276caf3dd5bb721a540ec014 was reported by an external researcher, and cb925073edeeb97eb4ce61a86cdafccc9b87f9bb was discovered internally by the vendor, but there is apparently no available information confirming that.
I noticed that on Red Hat's Bugzilla these two are aliased to CVE-2014-4740. Should thus CVE-2014-4740 be rejected, or is CVE-204-4740 used for something different? https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-4740 i.e. https://bugzilla.redhat.com/show_bug.cgi?id=1115983 . Regards, Salvatore
Current thread:
- CVE request: XSS in PNP4Nagios Murray McAllister (Jul 02)
- Re: CVE request: XSS in PNP4Nagios cve-assign (Jul 11)
- Re: Re: CVE request: XSS in PNP4Nagios Salvatore Bonaccorso (Jul 11)
- Re: CVE request: XSS in PNP4Nagios cve-assign (Jul 11)
- Re: Re: CVE request: XSS in PNP4Nagios Vasyl Kaigorodov (Jul 11)
- Re: CVE request: XSS in PNP4Nagios cve-assign (Jul 16)
- Re: Re: CVE request: XSS in PNP4Nagios Salvatore Bonaccorso (Jul 11)
- Re: CVE request: XSS in PNP4Nagios cve-assign (Jul 11)