PT-2015-7365

CVE-2015-6809

Published

2015-09-04

Updated

2015-09-04

Description by

CVSS 2.0

4.3

Medium

MetricsAV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions BEdita versions prior to 3.6.0

Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the cfg[projectName] parameter to "index.php/admin/saveConfig", the data[stats provider url] parameter to "index.php/areas/saveArea", or the data[description] parameter to "index.php/areas/saveSection".

Recommendations For versions prior to 3.6.0, update to version 3.6.0 or later to resolve the issue.

Exploitability

Exploit

Fix

Impacts

Researchers

Sébastien Morin

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers