OKCupid Cross Site Scripting

                							

                Title:    OKCupid Server Error Page XSS
Severity:   High
CVE-ID:   CVE-2014-3148
Re-release:  20 September 2014 
Author:   Kenneth F. Belva
Websites:  http://silverbackventuresllc.com
    http://xssWarrior.com 
    http://securitymaverick.com
Twitter:   @infosecmaverick
Contact:  Please use website contact form.
Mail: 
URL:     https://github.com/okws/okws
Vendor: 
Remote Exploit:  Yes


Description:
============

A non-existent page triggers the vulnerable XSS page.



Proof of Concept :
==================

http://okcupidserver/none/[code]


Various URLs :
==================

Public Release:
https://twitter.com/infosecmaverick/status/462573038299803648

Hacker1:
https://hackerone.com/reports/3317

Git Credit and Correction:
https://github.com/okws/okws/commit/e9bedb644d106a043e33e1058bedd1c2c0b2e2e0


Solution:
=========

Upgrade.


Remarks:
========

Thanks to @Sidnicious at OKCupid for such a quick fix and responsiveness



<p>