oss-security - CVE request: eZ Publish XSS

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <4680B31DCCC3B6428FB4E85ED9D540D0032B43@SRVEXCH.oppida.fr>
Date: Wed, 28 Mar 2012 12:11:52 +0000
From: Luc ABRIC <luc.abric@...ida.fr>
To: "'oss-security@...ts.openwall.com'" <oss-security@...ts.openwall.com>
CC: Karim SLAMANI <karim.slamani@...ida.fr>,
        Valérian PERRET <valerian.perret@...ida.fr>,
        Yann MICHARD
	<yann.michard@...ida.fr>,
        "'Jostein Knudsen'" <jkn@...no>
Subject: CVE request: eZ Publish XSS

Hi,

We identified a XSS vulnerability in the eZ Publish application. Here comes some details.

1) Email address of requester 
yann.michard@...ida.fr, luc.abric@...ida.fr & jkn@...no.
Yann MICHARD discovered the vulnerability, so all the credits goes to him.

2) Software name and optionally vendor name
Vendor: eZ
Product name: Ez Publish
Editions: both Enterprise & Community

3) At least one of (to determine is this a security issue):
   1. Type of vulnerability
 OWASP A2: Cross Site Scripting

   2. Exploitation vectors
 Access to the vulnerable website (no need for any credentials)

   3. Attack outcome
 A browser is enough to execute the attack.

4) For Open Source at least one of:
  1. Link to vulnerable source code or fix
 Not available yet.

  2. Link to source code change log
 Not available yet.

  3. Link to security advisory
 Not available yet.

  4. Link to bug entry
http://issues.ez.no/19283

  5. Request comes from project member (a.k.a. "trust me, it's a problem")
Knudsen <jkn@...no> from Ez can confirm the vulnerability.

5) Affected version(s) (3.2.4, 3.x, current version, all current releases, something)
The whole 4.x serie it seems (4.1 to 4.6 from the bug entry).

6) Whether or not this has been previously requested (i.e. on OSS-Sec or to cve-assign)
No, this is our first request relative to this vulnerability.

7) Is this an Open Source or commercial software request
Both, the affected software has 2 editions, one open-source, one commercial.

8) Is this an embargoed issue (if yes and commercial: send to cve-assign, if yes and open source: send to vs-sec?)
Nope.

9) IF multiple issues are listed please list affected versions for each issue and/or who reported them (so we can determine CVE split/merge).
The editor did now publish a Security Advisory yet, but he confirmed the vulnerability.
The first issue we reported on this application was affected the CVE 2012-1565, but we don't think it should be used for a merge as the 2 issues are distincts.

Regards,
Luc ABRIC
IT Security Expert

6 avenue du Vieil Etang - Bâtiment B
78180 Montigny-le-Bretonneux
Phone: +33 (0)1 30 14 19 00
Fax:       +33 (0)1 30 14 19 09
Mobile: +33 (0)6 26 87 62 14
luc.abric@...ida.fr

www.oppida.fr

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.