PT-2013-3402 · Django Software Foundation+1 · Django+1

Henri Salo · Published 2013-03-28 · Updated 2023-02-13 · CVE-2013-1808

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ZeroClipboard versions prior to 1.0.8

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the id parameter. This affects various products that use ZeroClipboard, including em-shorty, RepRapCalculator, Fulcrum, Django, and aCMS.

Recommendations For versions prior to 1.0.8, update to version 1.0.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the id parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2013-1808

Affected Products

Debian

Django

References · 24

• 🔥 http://securityvulns.ru/docs29104.html · Exploit
• 🔥 http://openwall.com/lists/oss-security/2013/03/10/2 · Exploit
• 🔥 http://securityfocus.com/bid/58257 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2013-1808 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1808 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2013-1808 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-1808 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-1808 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/db4o · Vendor Advisory
• https://github.com/jonrohan/ZeroClipboard/blob/master/docs/releases.md#zeroclipboard-108 · Note
• https://github.com/jonrohan/ZeroClipboard/commit/a0e02933f5f7ce5f364fbad36a005f0a349f0696 · Note
• http://openwall.com/lists/oss-security/2013/03/03/3 · Note
• http://seclists.org/fulldisclosure/2013/Apr/87 · Note
• http://openwall.com/lists/oss-security/2013/03/25/1 · Note
• http://seclists.org/fulldisclosure/2013/Mar/5 · Note