CVE-2011-1401

2011-04-1118:55:00

CWE-79

[email protected]

web.nvd.nist.gov

ikiwiki

htmlscrubber plugin

xss

cross-site scripting

cve-2011-1401

nvd

5.2 Medium

AI Score

Confidence

High

3.5 Low

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

0.002 Low

EPSS

Percentile

54.3%

JSON

ikiwiki before 3.20110328 does not ascertain whether the htmlscrubber plugin is enabled during processing of the “meta stylesheet” directive, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences in (1) the default stylesheet or (2) an alternate stylesheet.

CPENameOperatorVersion
ikiwiki:ikiwikiikiwikieq1.20
ikiwiki:ikiwikiikiwikieq2.8
ikiwiki:ikiwikiikiwikieq1.5
ikiwiki:ikiwikiikiwikieq3.07
ikiwiki:ikiwikiikiwikieq1.47
ikiwiki:ikiwikiikiwikieq1.43
ikiwiki:ikiwikiikiwikieq2.55
ikiwiki:ikiwikiikiwikieq3.14
ikiwiki:ikiwikiikiwikieq2.53
ikiwiki:ikiwikiikiwikieq3.14159

CPE	Name	Operator	Version
ikiwiki:ikiwiki	ikiwiki	eq	1.20
ikiwiki:ikiwiki	ikiwiki	eq	2.8
ikiwiki:ikiwiki	ikiwiki	eq	1.5
ikiwiki:ikiwiki	ikiwiki	eq	3.07
ikiwiki:ikiwiki	ikiwiki	eq	1.47
ikiwiki:ikiwiki	ikiwiki	eq	1.43
ikiwiki:ikiwiki	ikiwiki	eq	2.55
ikiwiki:ikiwiki	ikiwiki	eq	3.14
ikiwiki:ikiwiki	ikiwiki	eq	2.53
ikiwiki:ikiwiki	ikiwiki	eq	3.14159