PT-2012-3533 · Osqa · Osqa

Longrifle0X + 1 · Published 2012-03-19 · Updated 2012-03-20 · CVE-2012-1782

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions OSQA version 3b

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the (1) url bar or (2) picture bar.

Recommendations For OSQA version 3b, update to a version that includes a fix for the XSS vulnerabilities in the questions/ask functionality. As a temporary workaround, consider restricting user input in the url bar and picture bar to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2012-1782

Affected Products

Osqa

References · 5

• 🔥 http://archives.neohapsis.com/archives/bugtraq/2012-02/0164.html · Exploit
• 🔥 https://exploit-db.com/exploits/36886 · Exploit
• 🔥 http://securityfocus.com/bid/52184 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-1782 · Security Note
• http://vulnerability-lab.com/get_content.php?id=461 · Note