Anthill bug tracking system cross-site scripting
| anthill-bug-tracking-xss (8770) |  Medium Risk |
Description:
Anthill is vulnerable to cross-site scripting. A remote attacker could enter a bug report into the system containing malicious script embedded within HTML tags, which would be executed in the victim's Web browser once the vulnerable page is viewed. An attacker could use this vulnerability to steal another user's cookie-based authentication credentials.
Consequences:
Other
Remedy:
No remedy available as of July 9, 2011.
References:
- Anthill Web site: Anthill: PHP-Based Bugzilla Clone.
- BugTraq Mailing List, Sat Apr 06 2002 - 11:16:17 CST: Anthill login and JavaScript vulnerabilities.
- BID-4442: Anthill Cross-Agent Scripting Vulnerability
- CVE-2002-0549: Cross-site scripting vulnerabilities in Anthill allow remote attackers to execute script as other Anthill users.
Platforms Affected:
- Danen Consulting Services Anthill 0.1.6.1 and prior
Reported:
Apr 06, 2002
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net