STG Security Advisory 2004-11-22.12

`-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA1  
  
STG Security Advisory: [SSA-20041122-12] Zwiki XSS vulnerability  
  
Revision 1.1  
Date Published: 2004-11-22 (KST)  
Last Update: 2004-11-22  
Disclosed by SSR Team ([email protected])  
  
Summary  
========  
Zwiki is a wiki clone in zope. It has a cross site scripting vulnerability.  
  
Vulnerability Class  
===================  
Implementation Error: Input validation flaw  
  
Details  
=======  
Due to an input validation flaw, the Zwiki is vulnerable to cross site  
scripting attacks.  
  
cf. http://zwiki.org/925ZwikiXSSVulnerability  
  
proof of concept  
http://[victim]/<img src=javascript:alert('hi')>  
  
Impact  
======  
Medium: Malicious attackers can inject and execute arbitrary script code in  
a user's browser session in context of an affected site.  
  
Workaround  
==========  
There is no known workaround at this time.  
  
Affected Products  
================  
Zwiki 0.36.2 and prior  
  
Vendor Status: NOT FIXED  
=======================  
2004-10-01 Vulnerability found.  
2004-10-01 Zwiki developer notified.  
2004-11-22 Official release.  
  
Credits  
======  
Jeremy Bae at STG Security  
  
-----BEGIN PGP SIGNATURE-----  
Version: PGP 8.0  
  
iQA/AwUBQaP4tT9dVHd/hpsuEQJBogCg3Nbwv9aZ2ZDmQS4z17f2w8ogGukAnAoD  
Gbj1Yf87gJVSiLb+g/ky60tJ  
=ppK5  
-----END PGP SIGNATURE-----  
  
`