PT-2004-1464 · Livejournal · Livejournal

Joshua Miller · Published 2004-03-18 · Updated 2017-07-11 · CVE-2004-0310

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions LiveJournal versions 1.0 through 1.1

Description A cross-site scripting issue allows remote attackers to execute Javascript as other users via the stylesheet. The vulnerability is due to the stylesheet not stripping the semicolon or parentheses, which can be exploited to inject malicious code. This can be demonstrated by using a background:url in the stylesheet to execute arbitrary Javascript.

Recommendations For LiveJournal versions 1.0 and 1.1, consider restricting access to the stylesheet feature until a fix is available, and avoid using user-supplied input in the stylesheet to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2004-0310

Affected Products

Livejournal

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2004-0310 · Security Note
• http://marc.info/?l=bugtraq&m=107722627800820&w=2 · Note
• http://securityfocus.com/bid/9700 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/15268 · Note