Security-Alerts mailing list archive (security-alerts@yandex-team.ru)
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[security-alerts] FW: [SA28046] Apache mod_imagemap Module Cross-Site Scripting Vulnerability
> ----------------------------------------------------------------------
>
> TITLE:
> Apache mod_imagemap Module Cross-Site Scripting Vulnerability
>
> SECUNIA ADVISORY ID:
> SA28046
>
> VERIFY ADVISORY:
> http://secunia.com/advisories/28046/
>
> CRITICAL:
> Less critical
>
> IMPACT:
> Cross Site Scripting
>
> WHERE:
> From remote
>
> SOFTWARE:
> Apache 2.2.x
> http://secunia.com/product/9633/
>
> DESCRIPTION:
> A vulnerability has been reported in the mod_imagemap module for
> Apache, which can be exploited by malicious people to conduct
> cross-site scripting attacks.
>
> Certain unspecified input is not properly sanitised before being
> returned to the user. This can be exploited to execute arbitrary HTML
> and script code in a user's browser session in context of an affected
> site.
>
> Successful exploitation requires that "mod_imagemap" is enabled and a
> mapfile is publicly accessible.
>
> The vulnerability is reported in versions 2.2.6, 2.2.5, 2.2.4, 2.2.3,
> 2.2.2, and 2.2.0.
>
> SOLUTION:
> Fixed in the development version 2.2.7-dev.
>
> PROVIDED AND/OR DISCOVERED BY:
> Reported by the vendor.
>
> ORIGINAL ADVISORY:
> http://httpd.apache.org/security/vulnerabilities_22.html
>
|
