oss-sec mailing list archives
Re: CVE-request: Contao 2.10.1 Cross-site scripting vulnerability
From: Kurt Seifried <kseifried () redhat com>
Date: Mon, 21 Nov 2011 18:06:56 -0700
On 11/21/2011 03:41 PM, Henri Salo wrote:
----- Forwarded message from sschurtz () t-online de ----- Date: Sat, 8 Oct 2011 07:59:27 GMT From: sschurtz () t-online de To: bugtraq () securityfocus com Subject: Contao 2.10.1 Cross-site scripting vulnerability X-Mailer: MIME-tools 5.420 (Entity 5.420) Advisory: Contao 2.10.1 Cross-site scripting vulnerability Advisory ID: SSCHADV2011-025 Author: Stefan Schurtz Affected Software: Successfully tested on Contao 2.10.1 Vendor URL: http://www.contao.org/ Vendor Status: fixed CVE-ID: - ========================== Vulnerability Description: ========================== Contao 2.10 is prone to multiple Cross-site scripting vulnerability ================== Technical Details: ================== http://<target>/contao-2.10.1/index.php/teachers.html?"/><script>alert('xss')</script> http://<target>/contao-2.10.1/index.php/teachers/'"</style></script><script>alert(document.cookie)</script> ========= Solution: ========= - Vendor patch available - http://dev.contao.org/projects/typolight/repository/revisions/1041 - Release of a new version 2.10.2 next week ==================== Disclosure Timeline: ==================== 07-Oct-2011 - informed developers (contao () inetrobots com) 07-Oct-2011 - vendor fix 08-Oct-2011 - release date of this security advisory ======== Credits: ======== Vulnerability found and advisory written by Stefan Schurtz. =========== U References: =========== http://www.contao.org/ http://dev.contao.org/projects/typolight/repository/revisions/1041 http://www.rul3z.de/advisories/SSCHADV2011-025.txt ----- End forwarded message ----- Can you assign CVE-identifier for this vulnerability? http://dev.contao.org/projects/typolight/repository/revisions/8de5b536973a38ba75ebebfff16a5f0f29d99671 (reported 10/10/2011 03:09 pm) http://dev.contao.org/projects/typolight/repository/revisions/b7b2c2281227ad9c1647bf1f03e6d663b8387959 (reported 10/07/2011 01:33 pm) Best regards, Henri Salo
Please use CVE-2011-4335 for this issue. -- -Kurt Seifried / Red Hat Security Response Team
Current thread:
- CVE-request: Contao 2.10.1 Cross-site scripting vulnerability Henri Salo (Nov 21)
- Re: CVE-request: Contao 2.10.1 Cross-site scripting vulnerability Kurt Seifried (Nov 21)