oss-security - XSS in HTML Tidy plugin used in WYSIWYG HTML editors

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Mon, 27 Oct 2008 19:30:55 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
Subject: XSS in HTML Tidy plugin used in WYSIWYG HTML editors

http://www.securityfocus.com/bid/31908 covers a claimed issue in Kayako
eSupport that probably stems from an XSS in some plugin called HtmlTidy
which is for some WYSIWYG HTML editor called htmlArea.  Quick Google
searches suggest it may be in extensive use in various packages;
squirrelmail and Dragonfly were some of the products I've heard of that
popped up in early results.  I didn't dig deeply though.

This will have a CVE momentarily, but this post should be in the initial
CVE.  Chicken and egg thing basically...

- Steve

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.