PT-2013-4883 · Apache · Apache Roller

Published 2013-12-07 · Updated 2013-12-09 · CVE-2013-4171

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache Roller versions prior to 5.0.2

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The vulnerabilities are related to vectors in the search results, specifically in the RSS and Atom feed templates.

Recommendations For versions prior to 5.0.2, update to version 5.0.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the RSS and Atom feed templates until the update is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2013-4171

Affected Products

Apache Roller

References · 4

• http://secunia.com/advisories/55877 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-4171 · Security Note
• http://rollerweblogger.org/project/entry/apache_roller_5_0_2 · Patch
• http://secunia.com/advisories/55862 · Vendor Advisory