PT-2007-4954 · Ellislab · Codeigniter

Published 2007-07-11 · Updated 2018-10-15 · CVE-2007-3708

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions CodeIgniter version 1.5.3 before 20070626

Description The issue is related to a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML. This is due to insufficient sanitization by the xss clean function, specifically through the use of String.fromCharCode and malformed nested tag manipulations in an unspecified component.

Recommendations For CodeIgniter version 1.5.3 before 20070626, update to a version released after 20070626 to resolve the issue. As a temporary workaround, consider disabling the xss clean function until a patch is available, and ensure proper input validation and sanitization for all user-supplied data.

Fix

Related Identifiers

CVE-2007-3708

Affected Products

Codeigniter

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2007-3708 · Security Note
• http://secunia.com/advisories/25991 · Note
• http://securityfocus.com/archive/1/473190/100/0/threaded · Note
• http://osvdb.org/37907 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3708 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35350 · Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2007-July/064500.html · Note
• http://securityreason.com/securityalert/2877 · Note