CVE-2011-3979

Cross-site scripting (XSS) vulnerability in ztemp/view_compiled/Theme/theme_admin_setasdefault.php in the theme module in Zikula Application Framework 1.3.0 build 3168, 1.2.7, and probably other versions allows remote attackers to inject arbitrary web script or HTML via the themename parameter in the setasdefault action to index.php.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/bid/49491	Exploit
http://community.zikula.org/index.php?module=News&func=display&sid=3075	Patch
http://osvdb.org/75226
https://www.htbridge.ch/advisory/xss_in_zikula.html	Exploit
http://secunia.com/advisories/45884	Vendor Advisory
http://securityreason.com/securityalert/8409
https://exchange.xforce.ibmcloud.com/vulnerabilities/69644
http://www.securityfocus.com/archive/1/519565/100/0/threaded

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:zikula:zikula_application_framework:1.2.7:::::::*
	cpe:2.3:a:zikula:zikula_application_framework:1.3.0:::::::*

Information

Published : 2011-10-04 03:55

Updated : 2018-10-09 12:33

NVD link : CVE-2011-3979

Mitre link : CVE-2011-3979

JSON object : View

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Advertisement

Products Affected

zikula

zikula_application_framework

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.securityfocus.com/bid/49491", "name": "49491", "tags": ["Exploit"], "refsource": "BID"}, {"url": "http://community.zikula.org/index.php?module=News&func=display&sid=3075", "name": "http://community.zikula.org/index.php?module=News&func=display&sid=3075", "tags": ["Patch"], "refsource": "CONFIRM"}, {"url": "http://osvdb.org/75226", "name": "75226", "tags": [], "refsource": "OSVDB"}, {"url": "https://www.htbridge.ch/advisory/xss_in_zikula.html", "name": "https://www.htbridge.ch/advisory/xss_in_zikula.html", "tags": ["Exploit"], "refsource": "MISC"}, {"url": "http://secunia.com/advisories/45884", "name": "45884", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://securityreason.com/securityalert/8409", "name": "8409", "tags": [], "refsource": "SREASON"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/69644", "name": "zikulaapplication-index-xss(69644)", "tags": [], "refsource": "XF"}, {"url": "http://www.securityfocus.com/archive/1/519565/100/0/threaded", "name": "20110907 XSS in Zikula", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in ztemp/view_compiled/Theme/theme_admin_setasdefault.php in the theme module in Zikula Application Framework 1.3.0 build 3168, 1.2.7, and probably other versions allows remote attackers to inject arbitrary web script or HTML via the themename parameter in the setasdefault action to index.php."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-79"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2011-3979", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}}, "publishedDate": "2011-10-04T10:55Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:zikula:zikula_application_framework:1.2.7:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:zikula:zikula_application_framework:1.3.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-09T19:33Z"}