Cross-Site Scripting (XSS) in Jease

Advisory ID: HTB23104 Product: Jease Vendor: jease.org Vulnerable Versions: 2.8 and probably prior Tested Version: 2.8 Vendor Notification: July 25, 2012 Public Disclosure: August 15, 2012 Vulnerability Type: Cross-Site Scripting CWE-79 CVE Reference: CVE-2012-4052 CVSSv2 Base Score: 4.3...

CVE-2012-4052

CVE-2012-4052 concerns a cross-site scripting (XSS) vulnerability in Jease prior to 2.9. The issue arises when creating a comment, where the POST parameters for the fields (author, subject, comment) are not properly sanitized, allowing an attacker to inject arbitrary HTML/JavaScript executed in t...