[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAF1aazB_eBVHv75fjPKHQXvuq7jqZhz_9JOhqMhbpPPA+cVRFg@mail.gmail.com>
Date: Sat, 5 Aug 2023 16:12:10 -0400
From: Dave <snoopdave@...il.com>
To: Apache Security Team <security@...che.org>, oss-security@...ts.openwall.com,
srivani.reddy@...urelayer7.net, dev@...ler.apache.org,
Roller User <user@...ler.apache.org>
Subject: CVE-2023-37581: Apache Roller: XSS vulnerability for site with
untrusted users
The Apache Roller project would like to announce a vulnerability that may
impact Roller installations that allow group blogging with untrusted users.
Severity:
Medium (only impacts group blogging sites with untrusted users)
Description:
Insufficient input validation and sanitation in Weblog Category name,
Website About and File Upload features in all versions of Apache Roller on
all platforms allows an authenticated user to perform an XSS attack.
Mitigation:
If you are not running a group blog, then no mitigation is needed. If you
are running a group blog and you do not have Roller configured for
untrusted users, then you need to do nothing because you trust your users
to author raw HTML and other web content.
But, if you are running a group blog and you do not trust your users to
author HTML, CSS and JavaScript then you should upgrade to Roller 6.1.2 and
you should disable Roller's File Upload feature. Roller 6.1.2 is available
for download here: https://roller.apache.org/downloads/downloads.html
Apache Roller would like to thank Srivani Reddy for reporting this
vulnerability.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
