PT-2015-5031 · Bedita · Bedita
Steffen Rösemann
·
Published
2015-01-15
·
Updated
2015-01-15
·
CVE-2015-1040
CVSS v2.0
3.5
Low
| Vector | AV:N/AC:M/Au:S/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
BEdita version 3.4.0
Description
The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the administrative backend. These vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML via several fields, including the
lrealname field in the "editProfile" form to "index.php/home/profile", the data[title] or data[description] fields in the "addQuickItem" form to "index.php", the "note text" field in the "saveNote" form to "index.php/areas", or the titleBEObject or tagsArea fields in the "updateForm" form to "index.php/documents/view".Recommendations
For BEdita version 3.4.0, as a temporary workaround, consider restricting access to the administrative backend to minimize the risk of exploitation. Avoid using the vulnerable fields, such as
lrealname, data[title], data[description], "note text", titleBEObject, and tagsArea, in the respective forms until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Bedita