oss-security - Re: XSS in HTML Tidy plugin used in WYSIWYG HTML editors

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Mon, 27 Oct 2008 20:08:03 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
cc: coley@...re.org
Subject: Re: XSS in HTML Tidy plugin used in WYSIWYG HTML editors

======================================================
Name: CVE-2008-4761
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4761
Reference: MLIST:[oss-security] 20081027 XSS in HTML Tidy plugin used in WYSIWYG HTML editors
Reference: URL:http://www.openwall.com/lists/oss-security/2008/10/27/6
Reference: MISC:http://downloads.securityfocus.com/vulnerabilities/exploits/31908.html
Reference: BID:31908
Reference: URL:http://www.securityfocus.com/bid/31908
Reference: XF:esupport-htmltidylogic-xss(46097)
Reference: URL:http://xforce.iss.net/xforce/xfdb/46097

Cross-site scripting (XSS) vulnerability in
includes/htmlArea/plugins/HtmlTidy/html-tidy-logic.php in Kayako
eSupport 3.20.2 allows remote attackers to inject arbitrary web script
or HTML via the jsMakeSrc parameter.  NOTE: the provenance of this
information is unknown; the details are obtained solely from third
party information.  NOTE: this issue is probably in the HTMLArea
HTMLTidy (HTML Tidy) plugin, not eSupport.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.