Date: Tue, 29 Jan 2013 01:15:29 +0100 From: Moritz Naumann <security@...itz-naumann.com> To: oss-security@...ts.openwall.com Subject: CVE Request: XSS in Elgg 1.8.12, 1.7.16 (core module "Twitter widget") Hi, Elgg , versions 1.8.12 and 1.7.16 and earlier, bears a persistent script injection vulnerability in its core module "Twitter widget", which allows for XSS attacks. On installations which have the Twitter widget activated (disabled by default, but in use on many installations), any authenticated user may add the Twitter widget to their activity / dashboard page. Editing its configuration allows the user to set the twitter_username parameter. The value stored in this parameter will be echoed without sanitation  when the users' activity / dashboard page is requested (by the same or any other user, authenticated or not). According to changes committed  to their Git repository Elgg developers will provide a fix for this issue in the upcoming (?) 1.8.13 release. Reported by: Moritz Naumann http://moritz-naumann.com A CVE ID has, to my knowledge, not yet been assigned. Secunia has assigned it SA52007. A slightly more complete advisory should hit FD and Bugtraq any minute. Thanks, Moritz  http://elgg.org/  http://github.com/Elgg/Elgg/commit/a74a88501c41e89c8bcd7fc650ae2f8cc0a5003d#L2L21  http://github.com/Elgg/Elgg/commit/19dc507c2fccb378be2a44a762edf6c1e7afa334#L0R11
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ