PT-2007-4954 · Ellislab · Codeigniter

Publicado 2007-07-11 · Atualizado 2018-10-15 · CVE-2007-3708

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions CodeIgniter version 1.5.3 before 20070626

Description The issue is related to a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML. This is due to insufficient sanitization by the xss clean function, specifically through the use of String.fromCharCode and malformed nested tag manipulations in an unspecified component.

Recommendations For CodeIgniter version 1.5.3 before 20070626, update to a version released after 20070626 to resolve the issue. As a temporary workaround, consider disabling the xss clean function until a patch is available, and ensure proper input validation and sanitization for all user-supplied data.

Correção

Identificadores relacionados

CVE-2007-3708

Produtos afetados

Codeigniter

Referências · 8

• http://secunia.com/advisories/25991 · Nota
• http://securityfocus.com/archive/1/473190/100/0/threaded · Nota
• http://osvdb.org/37907 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3708 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35350 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-3708 · Nota de Segurança
• http://lists.grok.org.uk/pipermail/full-disclosure/2007-July/064500.html · Nota
• http://securityreason.com/securityalert/2877 · Nota