CGIWrap cross-site scripting
| cgiwrap-cross-site-scripting (6886) |  Medium Risk |
Description:
CGIWrap is vulnerable to cross-site scripting, caused by a user-supplied input validation error. A remote attacker could use this vulnerability to execute malicious scripts in other user's Web browsers.
Consequences:
Gain Access
Remedy:
Upgrade to the latest version of CGIWrap (3.7 or later), available from the SourceForge CGIWrap Download page. See References.
References:
- BugTraq Mailing List, Sun Jul 22 2001 - 12:39:03 CDT: Re: [cgiwrap-users] Re: Security hole in CGIWrap (cross-site scripting vulnerability).
- CGIWrap Web site: CGIWrap.
- SourceForge CGIWrap Download page: Index of /cgiwrap.
- BID-3084: CGIWrap Cross-Site Scripting Vulnerability
- CVE-2001-0987: Cross-site scripting vulnerability in CGIWrap before 3.7 allows remote attackers to execute arbitrary Javascript on other web clients by causing the Javascript to be inserted into error messages that are generated by CGIWrap.
- OSVDB ID: 1909: CGIWrap cgiwrap Multiple Variable XSS
Platforms Affected:
- Nathan Neulinger CGIWrap 3.6.4 and prior
Reported:
Jul 22, 2001
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net