PT-2013-4883 · Apache · Apache Roller

Publicado 2013-12-07 · Atualizado 2013-12-09 · CVE-2013-4171

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache Roller versions prior to 5.0.2

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The vulnerabilities are related to vectors in the search results, specifically in the RSS and Atom feed templates.

Recommendations For versions prior to 5.0.2, update to version 5.0.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the RSS and Atom feed templates until the update is applied.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2013-4171

Produtos afetados

Apache Roller

Referências · 4

• http://secunia.com/advisories/55877 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-4171 · Nota de Segurança
• http://rollerweblogger.org/project/entry/apache_roller_5_0_2 · Correção
• http://secunia.com/advisories/55862 · Aviso do Fabricante