PT-2009-1393 · Websvn · Websvn

James Bercegay · Published 2009-01-21 · Updated 2017-09-29 · CVE-2008-5918

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions WebSVN versions 2.0 and earlier

Description A cross-site scripting (XSS) issue exists in the getParameterisedSelfUrl function in index.php, allowing remote attackers to inject arbitrary web script or HTML via the PATH INFO. This could potentially lead to malicious script execution on the client-side.

Recommendations For WebSVN versions 2.0 and earlier, consider disabling the getParameterisedSelfUrl function in index.php as a temporary workaround until a patch is available. Restrict access to the index.php file to minimize the risk of exploitation. Avoid using the PATH INFO variable in the affected function until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-5918

Affected Products

Websvn

References · 12

• 🔥 https://exploit-db.com/exploits/6822 · Exploit
• 🔥 http://securityfocus.com/bid/31891 · Exploit
• 🔥 http://gulftech.org/?node=research&article_id=00132-10202008 · Exploit
• http://gentoo.org/security/en/glsa/glsa-200903-20.xml · Vendor Advisory
• http://websvn.tigris.org/servlets/NewsItemView?newsItemID=2218 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2008-5918 · Security Note
• http://secunia.com/advisories/32338 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46048 · Note
• http://secunia.com/advisories/34191 · Note
• http://websvn.tigris.org/issues/show_bug.cgi?id=179 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5918 · Note
• http://securityreason.com/securityalert/4928 · Note