PT-2012-5052 · Redaxo · Redaxo

Published 2012-08-13 · Updated 2012-08-14 · CVE-2012-3869

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions REDAXO versions 4.3.x through 4.4

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML. This is achieved via the subpage parameter to the "index.php" endpoint.

Recommendations For versions 4.3.x through 4.4, update to a version that fixes this issue. If no specific fix is provided for these versions, ensure to sanitize user input for the subpage parameter to prevent XSS attacks. As a temporary workaround, consider restricting access to the "index.php" endpoint until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2012-3869

Affected Products

Redaxo

References · 7

• 🔥 http://securityfocus.com/bid/54670 · Exploit
• 🔥 https://htbridge.com/advisory/HTB23098 · Exploit
• 🔥 http://archives.neohapsis.com/archives/bugtraq/2012-07/0142.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-3869 · Security Note
• http://secunia.com/advisories/49904 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3869 · Note
• http://redaxo.org/de/download/sicherheitshinweise · Note