[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAMWaY3P-bJSw2B2mEs2iDBgoZbuWNNg-AaUJxsPyGu1mOC+Ewg@mail.gmail.com>
Date: Fri, 13 Nov 2015 12:45:13 +0530
From: Dis close <disclose@...ersecurityworks.com>
To: cve-assign@...re.org
Cc: oss-security@...ts.openwall.com
Subject: CVE request: Reflected XSS in OcPortal CMS 9.0.20
Hello List:
Can a CVE be assigned to the following ?
Details
===========================
Title :Reflected cross-site scripting
vulnerability in *OcPortal CMS*
Version : 9.0.20
Vendor Homepage :http://ocportal.com/start.htm
Vulnerability Type :Reflected cross-site scripting vulnerability
(XSS)
Risk :High
Status :Fixed
Description
===============================
OcPortal CMS 9.0.20 is prone to a cross-site scripting vulnerability
because it fails to properly sanitize user-supplied input.A value in a
template that is not meant to contain HTML is marked as an escaped value
({VALUE*}). This meant that ‘html entities’ are put in replacement of HTML
control characters.
Vulnerable Parameter
===============================
[*FIELD_NAME*]
Remote Exploitable
===============================
*Yes*
Technical Details
==============================
https://github.com/cybersecurityworks/Disclosed/issues/11
Solution
==============================
Upgrade to latest version 9.0.21
https://ocportal.com/site/sites.htm
OR
Vendor has released patch for this issue, please refer below link
http://ocportal.com/site/news/view/security_issues/security-patch-for-xss.htm?filter=1%2C2%2C3%2C29%2C30
Timeline
==============================
2015-11-06 - First Contact
2015-11-06 - Vendor Response
2015-11-07 - Vendor Fixed
2015-11-13 - Public Disclosure
Credits & Author
==============================
Arjun Basnet from Cyber Security Works Pvt. Ltd (
http://www.cybersecurityworks.com/)
About Cybersecurityworks
==============================
Cybersecurity Works is basically an auditing company passionate working on
findings & reporting security flaws & vulnerabilities on web application
and network. As professionals, we handle each client differently based on
their unique requirements. Visit our website
http://www.cybersecurityworks.com/ for more information.
--
----------
Cheers !!!
Team CSW
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
