Description
Multiple cross-site scripting (XSS) vulnerabilities in Sage 1.3.6 allow remote attackers to inject arbitrary web script or HTML via JavaScript in a content:encoded element within an item element in an RSS feed, as demonstrated by four example content:encoded elements that use XMLHttpRequest to read arbitrary local files, aka "Cross Context Scripting."
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://www.securityfocus.com/bid/19928 ↗
- http://www.securityfocus.com/archive/1/445648/100/0/threaded ↗
- http://www.snellspace.com/wp/?p=410 ↗
- http://downloads.securityfocus.com/vulnerabilities/exploits/sage-inputvalidation.xml ↗
- http://www.vupen.com/english/advisories/2006/3553 ↗
- http://www.intertwingly.net/blog/2006/08/09/Attack-Delivery-TestSuite ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/28855 ↗
- http://www.gnucitizen.org/blog/cross-context-scripting-with-sage ↗
- http://www.snellspace.com/wp/?p=448 ↗
- http://securityreason.com/securityalert/1558 ↗
- http://secunia.com/advisories/21839 ↗