PT-2011-3099 · Joey Hess · Ikiwiki

Tango · Published 2011-04-11 · Updated 2024-06-15 · CVE-2011-1401

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ikiwiki versions prior to 3.20110328

Description The issue allows remote authenticated users to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences in the default stylesheet or an alternate stylesheet. This occurs because ikiwiki does not ascertain whether the htmlscrubber plugin is enabled during processing of the "meta stylesheet" directive.

Recommendations For versions prior to 3.20110328, update to version 3.20110328 or later to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2011-1401

DSA-2214-1

OPENSUSE-SU-2024:10860-1

Affected Products

Ikiwiki

References · 28

• http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058403.html · Vendor Advisory
• http://debian.org/security/2011/dsa-2214 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10860-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-1401 · Security Note
• https://osv.dev/vulnerability/CVE-2011-1401 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-1401 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-1401 · Vendor Advisory
• https://suse.com/security/cve/CVE-2016-10026 · Note
• https://suse.com/security/cve/CVE-2019-9187 · Note
• https://suse.com/security/cve/CVE-2014-1572 · Note
• https://suse.com/security/cve/CVE-2011-0428 · Note
• http://secunia.com/advisories/44079 · Note
• http://vupen.com/english/advisories/2011/1005 · Note
• https://suse.com/security/cve/CVE-2008-0169 · Note
• https://suse.com/security/cve/CVE-2012-0220 · Note