Cross site scripting

2011-04-1002:51:00

PRIOn knowledge base

www.prio-n.com

6.2 Medium

AI Score

Confidence

High

0.013 Low

EPSS

Percentile

85.8%

JSON

Cross-site scripting (XSS) vulnerability in app/controllers/todos_controller.rb in Tracks 1.7.2, 2.0RC2, and 2.0devel allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to todos/tag/. NOTE: some of these details are obtained from third party information.

CPENameOperatorVersion
trackseq2.0 devel
trackseq1.7.2
trackseq2.0 rc2

Name	Operator	Version
tracks	eq	2.0 devel
tracks	eq	1.7.2
tracks	eq	2.0 rc2

References

osvdb.org/71352

secunia.com/advisories/43909

securityreason.com/securityalert/8196

www.getontracks.org/downloads/comments/tracks-173

www.mavitunasecurity.com/XSS-vulnerability-in-Tracks/

www.securityfocus.com/archive/1/517223/100/0/threaded

www.securityfocus.com/bid/47078

exchange.xforce.ibmcloud.com/vulnerabilities/66561