Claroline "PHP_SELF" Variable Handling Client-Side Cross Site Scripting Vulnerability


Description   A vulnerability has been identified in Claroline, which could be exploited by attackers to execute arbitrary scripting code. This issue is caused by input validation errors in various scripts when processing the "PHP_SELF" variable, which could be exploited by attackers to cause arbitrary scripting code to be executed by the user's browser in the security context of an affected Web site.
     
Vulnerable Products   Vulnerable Software:
Claroline version 1.8.3 and prior
     
Solution   Upgrade to Claroline version 1.8.4 : http://www.claroline.net/download/stable.html
     
CVE   CVE-2007-3517
     
References   http://www.claroline.net/wiki/index.php/Changelog_1.8.x#Security
http://www.claroline.net/forum/viewtopic.php?t=11920
     
Vulnerability Manager Detection   No
     
IPS Protection  
ASQ Engine alarm Available Since
XSS - Prevention - GET : javascript code found in URL
3.2.0
XSS - Prevention - GET : 'script' tag found in URL
3.2.0
     


 
 
 
 
 Risk level 
Low 

 Vulnerability First Public Report Date 
2007-07-02 

 Target Type 
Client 

 Possible exploit 
Local & Remote