CVE-2011-1723

Опубликовано: 19 апр. 2011

Источник: nvd

CVSS2: 4.3

EPSS Низкий

Описание

Cross-site scripting (XSS) vulnerability in app/views/layouts/base.rhtml in Redmine 1.0.1 through 1.1.1 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to projects/hg-helloworld/news/. NOTE: some of these details are obtained from third party information.

Ссылки

http://osvdb.org/71564
http://secunia.com/advisories/43999
Vendor Advisory
http://securityreason.com/securityalert/8211
http://www.mavitunasecurity.com/XSS-vulnerability-in-Redmine/
Exploit
http://www.redmine.org/news/53
Patch
Vendor Advisory
http://www.securityfocus.com/archive/1/517355/100/0/threaded
http://www.securityfocus.com/bid/47193
Exploit
http://www.vupen.com/english/advisories/2011/0895
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/66612
http://osvdb.org/71564
http://secunia.com/advisories/43999
Vendor Advisory
http://securityreason.com/securityalert/8211
http://www.mavitunasecurity.com/XSS-vulnerability-in-Redmine/
Exploit
http://www.redmine.org/news/53
Patch
Vendor Advisory
http://www.securityfocus.com/archive/1/517355/100/0/threaded
http://www.securityfocus.com/bid/47193
Exploit
http://www.vupen.com/english/advisories/2011/0895
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/66612

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:redmine:redmine:1.0.1:*:*:*:*:*:*:*

cpe:2.3:a:redmine:redmine:1.0.2:*:*:*:*:*:*:*

cpe:2.3:a:redmine:redmine:1.0.3:*:*:*:*:*:*:*

cpe:2.3:a:redmine:redmine:1.0.4:*:*:*:*:*:*:*

cpe:2.3:a:redmine:redmine:1.0.5:*:*:*:*:*:*:*

cpe:2.3:a:redmine:redmine:1.1.0:*:*:*:*:*:*:*

cpe:2.3:a:redmine:redmine:1.1.1:*:*:*:*:*:*:*

EPSS

Процентиль: 91%

0.07068

Низкий

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

CVE-2011-1723

ubuntu

больше 14 лет назад

GHSA-3w96-rhq8-qmh8

github

больше 3 лет назад