PT-2011-2589 · Bazaar · Loggerhead

William Grant · Publicado 2011-03-29 · Atualizado 2022-05-17 · CVE-2011-0728

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Loggerhead versions prior to 1.18.1

Description The issue allows remote authenticated users to inject arbitrary web script or HTML via a filename, which is not properly handled in a revision view. This is due to a cross-site scripting (XSS) vulnerability in the templatefunctions.py file.

Recommendations For versions prior to 1.18.1, update to version 1.18.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the revision view to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2011-0728

GHSA-QJMG-77XH-7MJW

Produtos afetados

Loggerhead

Referências · 18

• http://secunia.com/advisories/44017 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057502.html · Aviso do Fabricante
• http://secunia.com/advisories/43822 · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057413.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2011-0728 · Nota de Segurança
• https://launchpad.net/loggerhead/1.18/1.18.1 · Correção
• http://osvdb.org/71279 · Nota
• https://bugs.launchpad.net/loggerhead/+bug/740142 · Correção
• http://vupen.com/english/advisories/2011/0848 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66305 · Nota
• https://security-tracker.debian.org/tracker/CVE-2011-0728 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-qjmg-77xh-7mjw · Aviso do Fabricante
• http://vupen.com/english/advisories/2011/0849 · Nota
• http://securityfocus.com/bid/47032 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057479.html · Aviso do Fabricante