Dt25

Improper neutralization of input during web page generation leads to Cross-site Scripting (XSS), a condition where malicious scripts are injected into trusted websites. A weblog administrator can store a script that executes in the browsers of weblog members when they access the main menu. This occurs because the HTML-stripping routine fails to remove an unclosed tag, and the main menu displays the weblog description without proper escaping.

An authorization flaw exists where a weblog member assigned the Limited role can modify or delete entries they are only permitted to read, including those created by other members. This occurs because the entry editor verifies the member's general weblog role but fails to check if that specific role grants permission to perform actions on the particular entry.