[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <5116F47B.5050506@redhat.com>
Date: Sat, 09 Feb 2013 18:14:35 -0700
From: Kurt Seifried <kseifried@...hat.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>,
Raphael Geissert <geissert@...ian.org>
Subject: CVE request: piwigo XSS in password.php
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
So Henri Salo pointed out that I never assigned a CVE for this:
http://www.openwall.com/lists/oss-security/2012/10/06/2
Which raises a good note: do not be afraid to bug me if some time goes
by without an answer or at least a reply/question.
> Hi,
>
> A XSS vulnerability has been reported in piwigo's password.php
> before 2.4.4: http://piwigo.org/bugs/view.php?id=0002750
> http://secunia.com/advisories/50510/
>
> However, as stated in the Secunia advisory, the fix does not
> entirely address the issue. For context, the
> stripslashes/strip_tags'ed POST variable is included in the
> template as following: <input type="text" id="username_or_email"
> name="username_or_email" ... value="{$username_or_email}">
>
> (some parts redacted for clarity)
>
> So, two ids are needed. Thanks in advance.
>
> Piwigo 2.3.1 also seems to be affected but 2.1.2 doesn't.
>
> -- Raphael Geissert - Debian Developer www.debian.org -
> get.debian.net
Please use CVE-2012-6126 for this issue.
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
iQIcBAEBAgAGBQJRFvR7AAoJEBYNRVNeJnmTRWAQAKWh7eI79o0iOrfHh0lyBg5h
aQTaKzguxScUSlHtoxdjtUoV5y8W2jTx7lT1t+ZT5M91LRMhkRtKlUrBu074w+uF
cC7rvNzLhAfxf66v32JeBndrkQP3+qprUQVykaOlY//cyN4cLUKtt4YbJuQ6OCo+
xjYlO8JsdJ6d6J9pJQU4lVjSxx6oNwwZPJAo85w/4l9aJ6PzraI0NHV27KJzPs0n
pJ+bvO/ysdkiA7N7yrsINF3WPooSFdK2P6eI9Rup18KrGs5Fh7d93iZgjR8RRnb4
JiKhulKugwSF+CvkRs5qmbaqF5ZHVoyFYU+lDAf2gqYqtrVfdJZ5NoIMa1zvtxP8
6OtPvBQwJoa0+oe7R8M8EhSKjEXUfZimuNJI0xMbB2GsDZ3wzVr7CPsTuxnKJ1HY
CyAmTGUqZcDZoaw9DdDqBvyL/hHrV+LmXH0bHXHgvcwVpbmF2QHXB60cu/paaA4/
F7EdVN0fsWBSETQnRJyEQvLbLQ019QLmgopfhqrIBdmT/8zWx0+nUjG3PpcgfYTz
kxaCcB491C1on8+2fBEBDTankdAhxRJu6OxOttz094FhP0TECOHmGd+Yio6z1YrF
Oy6pzEXNjUMBQNyS/icQ5f46haa86i6bSTXg8yyXE9eRAUfQTVrWQIQtDz1Vhoxh
NULD/c1cFjBNWFZ+iB0y
=yOI7
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
