|
Description
|
|
Sony has discovered multiple vulnerabilities in GForge Community Edition and Advanced Server, which can be exploited by malicious people to conduct cross-site scripting attacks.
1) Input passed to the "id" parameter in e.g. gf/user/gforgeadmin/userblog/my/admin/ (when "action" is set to "UserblogDelete" and "id" is prefixed with a valid blog post id) is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
2) Input passed to the "start_date" parameter in e.g. gf/user/gforgeadmin/usercalendar/my/admin/ (when "action" is set to "UsercalendarEventDelete" and "event_id" is set to a valid calendar event id) is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
Vulnerabilities #1 and #2 are confirmed in GForge Advanced Server version 6.0.0. Other versions may also be affected.
3) Input passed to the "file_id" parameter in e.g. gf/user/gforgeadmin/userfiles/my/admin/ (when "action" is set to "UserfileDelete" and "file_id" is prefixed with a valid file id) is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
4) Input passed to the "words" parameter in gf/admin/popups/ (when "action" is set to "findusers" and "search" is set to e.g. "user_0") is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
Vulnerabilities #3 and #4 are confirmed in GForge Community Edition version 5.7.1 and GForge Advanced Server version 6.0.0. Other versions may also be affected.
|
|
|
|
|
|
Vulnerable Products
|
|
Vulnerable Software:
GForge Advanced Server 6.xGForge Community Edition 5.x
|
|
|
|
|
|
Solution
|
|
Filter malicious characters and character sequences using a proxy.
|
|
|
|
|
|
CVE
|
|
|
|
|
|
|
|
References
|
|
http://st2tea.blogspot.com/2012/01/gforge-cross-site-scripting.html
|
|
|
|
|
|
Vulnerability Manager Detection
|
|
No
|
|
|
|
|
|
IPS Protection
|
|
|
|
|
|
|
