Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Fri, 13 Nov 2015 12:45:13 +0530
From: Dis close <>
Subject: CVE request: Reflected XSS in OcPortal CMS 9.0.20

Hello List:

Can a CVE be assigned to the following ?

Title                              :Reflected cross-site scripting
vulnerability in *OcPortal CMS*
Version                         : 9.0.20
Vendor Homepage         :
Vulnerability Type          :Reflected cross-site scripting vulnerability
Risk                             :High
Status                          :Fixed

OcPortal CMS 9.0.20 is prone to a cross-site scripting vulnerability
because it fails to properly sanitize user-supplied input.A value in a
template that is not meant to contain HTML is marked as an escaped value
({VALUE*}). This meant that ‘html entities’ are put in replacement of HTML
control characters.

Vulnerable Parameter

Remote Exploitable

Technical Details

Upgrade to latest version 9.0.21


Vendor has released patch for this issue, please refer below link

2015-11-06 - First Contact
2015-11-06 - Vendor Response
2015-11-07 - Vendor Fixed
2015-11-13 - Public Disclosure

Credits & Author
Arjun Basnet from Cyber Security Works Pvt. Ltd (

About Cybersecurityworks
Cybersecurity Works is basically an auditing company passionate working on
findings & reporting security flaws & vulnerabilities on web application
and network. As professionals, we handle each client differently based on
their unique requirements. Visit our website for more information.

Cheers !!!

Team CSW

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.