PT-2009-1393 · Websvn · Websvn

James Bercegay · Publicado 2009-01-21 · Atualizado 2017-09-29 · CVE-2008-5918

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions WebSVN versions 2.0 and earlier

Description A cross-site scripting (XSS) issue exists in the getParameterisedSelfUrl function in index.php, allowing remote attackers to inject arbitrary web script or HTML via the PATH INFO. This could potentially lead to malicious script execution on the client-side.

Recommendations For WebSVN versions 2.0 and earlier, consider disabling the getParameterisedSelfUrl function in index.php as a temporary workaround until a patch is available. Restrict access to the index.php file to minimize the risk of exploitation. Avoid using the PATH INFO variable in the affected function until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-5918

Produtos afetados

Websvn

Referências · 12

• 🔥 https://exploit-db.com/exploits/6822 · Exploit
• 🔥 http://securityfocus.com/bid/31891 · Exploit
• 🔥 http://gulftech.org/?node=research&article_id=00132-10202008 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46048 · Nota
• http://secunia.com/advisories/34191 · Nota
• http://websvn.tigris.org/issues/show_bug.cgi?id=179 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5918 · Nota
• http://gentoo.org/security/en/glsa/glsa-200903-20.xml · Aviso do Fabricante
• http://securityreason.com/securityalert/4928 · Nota
• http://websvn.tigris.org/servlets/NewsItemView?newsItemID=2218 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2008-5918 · Nota de Segurança
• http://secunia.com/advisories/32338 · Aviso do Fabricante