PT-2011-2589 · Bazaar · Loggerhead

William Grant · Published 2011-03-29 · Updated 2022-05-17 · CVE-2011-0728

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Loggerhead versions prior to 1.18.1

Description The issue allows remote authenticated users to inject arbitrary web script or HTML via a filename, which is not properly handled in a revision view. This is due to a cross-site scripting (XSS) vulnerability in the templatefunctions.py file.

Recommendations For versions prior to 1.18.1, update to version 1.18.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the revision view to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2011-0728

GHSA-QJMG-77XH-7MJW

Affected Products

Loggerhead

References · 18

• http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057502.html · Vendor Advisory
• http://secunia.com/advisories/43822 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057413.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-0728 · Security Note
• https://launchpad.net/loggerhead/1.18/1.18.1 · Patch
• https://bugs.launchpad.net/loggerhead/+bug/740142 · Patch
• https://security-tracker.debian.org/tracker/CVE-2011-0728 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qjmg-77xh-7mjw · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057479.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-0728 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-0728 · Vendor Advisory
• http://secunia.com/advisories/44017 · Note
• http://osvdb.org/71279 · Note
• http://vupen.com/english/advisories/2011/0848 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66305 · Note