Published: 30/09/2011 Updated: 18/05/2012

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 440

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Multiple cross-site scripting (XSS) vulnerabilities in TWiki prior to 5.1.0 allow remote malicious users to inject arbitrary web script or HTML via (1) the newtopic parameter in a WebCreateNewTopic action, related to the TWiki.WebCreateNewTopicTemplate topic; or (2) the query string to SlideShow.pm in the SlideShowPlugin.

Vulnerable Product	Search on Vulmon	Subscribe to Product
twiki twiki 4.5.0
twiki twiki 4.3.0
twiki twiki 4.1.1
twiki twiki 4.0.5
twiki twiki 4.0.0
twiki twiki
twiki twiki 5.0.0
twiki twiki 4.0.4
twiki twiki 4.0.3
twiki twiki 4.0.2
twiki twiki 4.0.1
twiki twiki 4.2.3
twiki twiki 4.2.2
twiki twiki 4.2.1
twiki twiki 4.2.0
twiki twiki 4.3.2
twiki twiki 4.2.4
twiki twiki 4.1.2
twiki twiki 4.1.0
twiki twiki 4.0

TWiki versions prior to 510 suffer from cross site scripting vulnerabilities ...

source: wwwsecurityfocuscom/bid/49746/info TWiki is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site This may allow the atta ...

source: wwwsecurityfocuscom/bid/49746/info TWiki is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site This may allow the at ...

CWE-79 http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2011-3010 http://archives.neohapsis.com/archives/bugtraq/2011-09/0142.html http://www.securityfocus.com/bid/49746 http://securitytracker.com/id?1026091 http://secunia.com/advisories/46123 http://www.osvdb.org/75674 http://develop.twiki.org/trac/changeset/21920 http://www.mavitunasecurity.com/xss-vulnerability-in-twiki5 http://www.osvdb.org/75673 https://nvd.nist.gov https://packetstormsecurity.com/files/105309/TWiki-Cross-Site-Scripting.html https://www.exploit-db.com/exploits/36162/

CVE-2011-3010

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect