CVE-2011-4923

Name of the Vulnerable Software and Affected Versions BackupPC versions 3.0.0 through 3.2.1

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the num parameter in a view action to "index.cgi", related to the log file viewer.

Recommendations For versions 3.0.0 through 3.2.1, as a temporary workaround, consider restricting access to the "index.cgi" endpoint until a patch is available. Avoid using the num parameter in the affected "index.cgi" endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.