Информационная безопасность
[RU] switch to English


Дополнительная информация

  Cводка уязвимостей безопасности в Web-приложениях (PHP, ASP, JSP, CGI, Perl)

  TWSL2011-013: Multiple Vulnerabilities in IceWarp Mail Server

  PunBB 1.3.6 bug

  Serendipity freetag plugin 'serendipity[tagv
iew]' Cross-Site Scripting vulnerability

  AdaptCMS 2.0.1 Multiple security vulnerabilities

From:Netsparker Advisories <advisories_(at)_mavitunasecurity.com>
Date:26 сентября 2011 г.
Subject:XSS Vulnerabilities in TWiki < 5.1.0

Information------------------Name : XSS vulnerability in TWikiSoftware
: TWiki 5.0.2 and below.Vendor Hompeage :
http://twiki.org/Vulnerability Type : Cross-Site ScriptingSeverity :
HighResearcher : Mesut Timur <mesut [at] mavitunasecurity [dot]
com>Advisory Reference :  NS-11-006CVE :  CVE-2011-3010

Description-----------------------------------TWiki® is a flexible,
powerful, and easy to use enterprise wiki,enterprise collaboration
platform, and web application platform. It isa Structured Wiki,
typically used to run a project development space,a document
management system, a knowledge base, or any other groupwaretool, on an
intranet, extranet or the Internet.

Details-----------------------------------TTWiki is affected by XSS
vulnerabilities in version 5.0.2.Example PoC url is as follows :
http://example.com/do/view/Main/Jump?create=on&newtopic=%27%22--
%3E%3C/style%3E%3C/script%3E%3Cscript%3Ealert%280
x0051D1%29%3C/script%3E&template=WebCreateNewTopic&topicparen
t=3http://example.com/do/view/TWiki/ATasteOfTWiki?'"--
></style></script><script>alert(0x002B48)</script
>
You can read the full article about Cross-Site
Scriptingvulnerabilities from here
:http://www.mavitunasecurity.com/crosssite-scripting-xss/

Solution-----------------------------------Upgrade to the latest TWiki
version (5.1.0).

Credits-----------------------------------It has been discovered on
testing of Netsparker, Web ApplicationSecurity Scanner -
http://www.mavitunasecurity.com/netsparker/.

References-----------------------------------Vendor Url :
CVE-2011-3010MSL" class="fixed">http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2011-3010MSL
Advisory Link :
http://www.mavitunasecurity.com/xss-vulnerability-in-twiki5/Netsparker
Advisories : http://www.mavitunasecurity.com/netsparker-advisories/
About Netsparker-----------------------------------Netsparker® can
find and report security issues such as SQL Injectionand Cross-site
Scripting (XSS) in all web applications regardless ofthe platform and
the technology they are built on. Netsparker's uniquedetection and
exploitation technique
--
Netsparker Advisories, <[email protected]>
Homepage, http://www.mavitunasecurity.com/netsparker-advisories/

О сайте | Условия использования
© SecurityVulns, 3APA3A, Владимир Дубровин
Нижний Новгород