PT-2007-7295 · Flyspray · Flyspray

Publicado 2007-12-20 · Atualizado 2008-11-15 · CVE-2007-6461

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Flyspray versions 0.9.9 through 0.9.9.3

Description The issue allows remote attackers to inject arbitrary web script or HTML via the query string in an index action, related to the savesearch JavaScript function, and the details parameter in a details action, related to the History tab and the getHistory JavaScript function.

Recommendations For Flyspray versions 0.9.9 through 0.9.9.3, consider disabling the savesearch and getHistory JavaScript functions as a temporary workaround until a patch is available. Restrict access to the details parameter in the details action to minimize the risk of exploitation. Avoid using the query string in an index action until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2007-6461

Produtos afetados

Flyspray

Referências · 6

• http://secunia.com/advisories/28106 · Aviso do Fabricante
• http://osvdb.org/39257 · Nota
• http://osvdb.org/39256 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6461 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-6461 · Nota de Segurança
• http://flyspray.org/fsa:2 · Nota