Vulners
Lucene search
LiveZilla 5.1.0.0 Cross Site Scripting
| Reporter | Title | Published | Views | Family All 9 |
|---|---|---|---|---|
 | CVE-2013-7002 | 21 Dec 201300:00 | – | cve |
 | CVE-2013-7002 | 21 Dec 201300:00 | – | cvelist |
 | EUVD-2013-6803 | 7 Oct 202500:30 | – | euvd |
 | LiveZilla < 5.1.1.0 Multiple Vulnerabilities | 14 Dec 201300:00 | – | nessus |
 | CVE-2013-7002 | 21 Dec 201300:55 | – | nvd |
 | LiveZilla 'g_language' Parameter Cross Site Scripting Vulnerability | 17 Dec 201300:00 | – | openvas |
 | Cross site scripting | 21 Dec 201300:55 | – | prion |
 | LiveZilla 5.1.0.0 Reflected XSS in translations | 9 Dec 201300:00 | – | securityvulns |
| Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl) | 9 Dec 201300:00 | – | securityvulns |
`Author: Jakub Zoczek [[email protected]]
CVE Reference: CVE-2013-7002
Product: LiveZilla
Vendor: LiveZilla GmbH [http://livezilla.net]
Affected version: 5.1.0.0
Severity: Medium
CVSSv2 Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Status: Fixed
0x01 Background
LiveZilla, the widely-used and trusted Live Help and Live Support System.
0x02 Description
LiveZilla in version 5.1.0.0 is prone to Reflected Cross-Site Scripting issue in translation PHP script used to generate JSON with connections between origin and destination languages. Content type is text/html and g_language GET variable is displayed without sanitization, which make the script vulnerable.
0x03 Proof of Concept
http://hostname/livezilla/mobile/php/translation/index.php?g_language=f"><img src=a onerror=alert('XSS')>h
0x04 Fix
Vulnerability was fixed in LiveZilla 5.1.1.0 version.
0x05 Timeline
20.11.2013 - Vendor notified
21.11.2013 - Fix released, vendor responded
09.12.2013 - Public Disclosure
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
09 Dec 2013 00:00Current
9.6High risk
Vulners AI Score9.6
EPSS0.0034