CVE-2011-3010
Severity CVSS v4.0:
Pending analysis
Type:
CWE-79
Cross-Site Scripting (XSS)
Publication date:
30/09/2011
Last modified:
18/05/2012
Description
Multiple cross-site scripting (XSS) vulnerabilities in TWiki before 5.1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the newtopic parameter in a WebCreateNewTopic action, related to the TWiki.WebCreateNewTopicTemplate topic; or (2) the query string to SlideShow.pm in the SlideShowPlugin.
Impact
Base Score 2.0
4.30
Severity 2.0
MEDIUM
Vulnerable products and versions
CPE | From | Up to |
---|---|---|
cpe:2.3:a:twiki:twiki:*:*:*:*:*:*:*:* | 5.0.1 (including) | |
cpe:2.3:a:twiki:twiki:4.0:*:*:*:*:*:*:* | ||
cpe:2.3:a:twiki:twiki:4.0.0:*:*:*:*:*:*:* | ||
cpe:2.3:a:twiki:twiki:4.0.1:*:*:*:*:*:*:* | ||
cpe:2.3:a:twiki:twiki:4.0.2:*:*:*:*:*:*:* | ||
cpe:2.3:a:twiki:twiki:4.0.3:*:*:*:*:*:*:* | ||
cpe:2.3:a:twiki:twiki:4.0.4:*:*:*:*:*:*:* | ||
cpe:2.3:a:twiki:twiki:4.0.5:*:*:*:*:*:*:* | ||
cpe:2.3:a:twiki:twiki:4.1.0:*:*:*:*:*:*:* | ||
cpe:2.3:a:twiki:twiki:4.1.1:*:*:*:*:*:*:* | ||
cpe:2.3:a:twiki:twiki:4.1.2:*:*:*:*:*:*:* | ||
cpe:2.3:a:twiki:twiki:4.2.0:*:*:*:*:*:*:* | ||
cpe:2.3:a:twiki:twiki:4.2.1:*:*:*:*:*:*:* | ||
cpe:2.3:a:twiki:twiki:4.2.2:*:*:*:*:*:*:* | ||
cpe:2.3:a:twiki:twiki:4.2.3:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- http://archives.neohapsis.com/archives/bugtraq/2011-09/0142.html
- http://develop.twiki.org/trac/changeset/21920
- http://secunia.com/advisories/46123
- http://securitytracker.com/id?1026091=
- http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2011-3010
- http://www.mavitunasecurity.com/xss-vulnerability-in-twiki5
- http://www.osvdb.org/75673
- http://www.osvdb.org/75674
- http://www.securityfocus.com/bid/49746