PT-2011-3099 · Joey Hess · Ikiwiki

Tango · Publicado 2011-04-11 · Atualizado 2024-06-15 · CVE-2011-1401

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ikiwiki versions prior to 3.20110328

Description The issue allows remote authenticated users to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences in the default stylesheet or an alternate stylesheet. This occurs because ikiwiki does not ascertain whether the htmlscrubber plugin is enabled during processing of the "meta stylesheet" directive.

Recommendations For versions prior to 3.20110328, update to version 3.20110328 or later to resolve the issue.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2011-1401

DSA-2214-1

OPENSUSE-SU-2024:10860-1

Produtos afetados

Ikiwiki

Referências · 28

• https://suse.com/security/cve/CVE-2016-10026 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058403.html · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2019-9187 · Nota
• https://suse.com/security/cve/CVE-2014-1572 · Nota
• https://suse.com/security/cve/CVE-2011-0428 · Nota
• http://secunia.com/advisories/44079 · Nota
• http://debian.org/security/2011/dsa-2214 · Aviso do Fabricante
• http://vupen.com/english/advisories/2011/1005 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2024:10860-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2011-1401 · Nota de Segurança
• https://suse.com/security/cve/CVE-2008-0169 · Nota
• https://osv.dev/vulnerability/CVE-2011-1401 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2012-0220 · Nota
• https://suse.com/security/cve/CVE-2016-1238 · Nota
• http://securityfocus.com/bid/47285 · Nota