CVE-2010-3841

Multiple cross-site scripting (XSS) vulnerabilities in lib/TWiki.pm in TWiki before 5.0.1 allow remote attackers to inject arbitrary web script or HTML via (1) the rev parameter to the view script or (2) the query string to the login script.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://secunia.com/advisories/41796	Vendor Advisory
http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2010-3841	Exploit Patch Vendor Advisory
http://www.securityfocus.com/bid/44103	Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/62557

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:twiki:twiki::::::::
	cpe:2.3:a:twiki:twiki:4.0.0:::::::*
	cpe:2.3:a:twiki:twiki:4.0.1:::::::*
	cpe:2.3:a:twiki:twiki:4.0.2:::::::*
	cpe:2.3:a:twiki:twiki:4.0.3:::::::*
	cpe:2.3:a:twiki:twiki:4.0.4:::::::*
	cpe:2.3:a:twiki:twiki:4.0.5:::::::*
	cpe:2.3:a:twiki:twiki:4.1.0:::::::*
	cpe:2.3:a:twiki:twiki:4.1.1:::::::*
	cpe:2.3:a:twiki:twiki:4.1.2:::::::*
	cpe:2.3:a:twiki:twiki:4.2.2:::::::*
	cpe:2.3:a:twiki:twiki:4.2.3:::::::*
	cpe:2.3:a:twiki:twiki:4.2.4:::::::*
	cpe:2.3:a:twiki:twiki:4.3.0:::::::*
	cpe:2.3:a:twiki:twiki:4.3.1:::::::*
	cpe:2.3:a:twiki:twiki:4.3.2:::::::*
	cpe:2.3:a:twiki:twiki:2000-12-01:::::::*
	cpe:2.3:a:twiki:twiki:2001-09-01:::::::*
	cpe:2.3:a:twiki:twiki:2001-12-01:::::::*
	cpe:2.3:a:twiki:twiki:2003-02-01:::::::*
	cpe:2.3:a:twiki:twiki:2004-09-01:::::::*
	cpe:2.3:a:twiki:twiki:2004-09-02:::::::*
	cpe:2.3:a:twiki:twiki:2004-09-03:::::::*
	cpe:2.3:a:twiki:twiki:2004-09-04:::::::*

History

No history.

Information

Published : 2010-10-18 17:00

Updated : 2023-12-10 11:03

NVD link : CVE-2010-3841

Mitre link : CVE-2010-3841

CVE.ORG link : CVE-2010-3841

JSON object : View

Products Affected

twiki

twiki

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2010-3841", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2010-10-18T17:00:04.063", "references": [{"url": "http://secunia.com/advisories/41796", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2010-3841", "tags": ["Exploit", "Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/44103", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/62557", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in lib/TWiki.pm in TWiki before 5.0.1 allow remote attackers to inject arbitrary web script or HTML via (1) the rev parameter to the view script or (2) the query string to the login script."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en lib/TWiki.pm de TWiki en versiones anteriores a la v5.0.1 permiten a atacantes remotos inyectar codigo de script web o c\u00f3digo HTML de su elecci\u00f3n a trav\u00e9s de (1) el par\u00e1metro rev al script view o (2) la cadena de consulta del script de login."}], "lastModified": "2017-08-17T01:33:03.697", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:twiki:twiki:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A4EB3542-A00F-49B5-B38D-196E0FA8C8E7", "versionEndIncluding": "5.0.0"}, {"criteria": "cpe:2.3:a:twiki:twiki:4.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F893E121-82FA-41C8-9BA4-606E6DA01408"}, {"criteria": "cpe:2.3:a:twiki:twiki:4.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "47807C3A-8430-48E3-A7C8-C5A1FEDF84C0"}, {"criteria": "cpe:2.3:a:twiki:twiki:4.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "620356EA-F106-41DF-AADA-C1EF5A5A0829"}, {"criteria": "cpe:2.3:a:twiki:twiki:4.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "979D8BC8-0032-496F-9503-F3BBBC8FA7CF"}, {"criteria": "cpe:2.3:a:twiki:twiki:4.0.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0804FF93-6554-4F56-9974-017198ED5F44"}, {"criteria": "cpe:2.3:a:twiki:twiki:4.0.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "41445C95-0309-4B90-B725-87D2FE87C9A5"}, {"criteria": "cpe:2.3:a:twiki:twiki:4.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C9996E5B-36AD-407F-B3B6-839CE8E5913E"}, {"criteria": "cpe:2.3:a:twiki:twiki:4.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "748325A4-A237-498A-A185-905FC921D2A3"}, {"criteria": "cpe:2.3:a:twiki:twiki:4.1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9FE3EEC6-7E05-4A37-97AA-D73E7D7A0E01"}, {"criteria": "cpe:2.3:a:twiki:twiki:4.2.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E9CF4F9B-7ADF-47A2-A556-10CCF7401DA9"}, {"criteria": "cpe:2.3:a:twiki:twiki:4.2.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "81DDB420-E707-4319-8395-531FC0D84E5B"}, {"criteria": "cpe:2.3:a:twiki:twiki:4.2.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0D7A5A57-AE7D-4D3E-A280-41676F355AEE"}, {"criteria": "cpe:2.3:a:twiki:twiki:4.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "710F8276-1147-4EAD-9C34-5F2FEE636F8D"}, {"criteria": "cpe:2.3:a:twiki:twiki:4.3.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DD7698E4-32E0-4228-94C7-83E5E7CF83E7"}, {"criteria": "cpe:2.3:a:twiki:twiki:4.3.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8CBEFD95-CB78-4C25-BB41-EB96C780F2F6"}, {"criteria": "cpe:2.3:a:twiki:twiki:2000-12-01:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "89599BC3-E1D8-4670-9321-F63A788096A0"}, {"criteria": "cpe:2.3:a:twiki:twiki:2001-09-01:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "354C8BA8-603D-4556-8C4C-39DEE4891719"}, {"criteria": "cpe:2.3:a:twiki:twiki:2001-12-01:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "23CC3B43-A77A-471E-A0ED-E91E53C2400C"}, {"criteria": "cpe:2.3:a:twiki:twiki:2003-02-01:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "374ADC0F-0EE2-4DEC-8A37-5F5F15C8137A"}, {"criteria": "cpe:2.3:a:twiki:twiki:2004-09-01:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BEC5965A-BFC8-42B3-AF13-28E097381E84"}, {"criteria": "cpe:2.3:a:twiki:twiki:2004-09-02:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C94AFFF9-5951-43A9-8018-B10C3F097CE9"}, {"criteria": "cpe:2.3:a:twiki:twiki:2004-09-03:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5F823DF7-B38E-4FBF-8D9A-C1B49FC237BE"}, {"criteria": "cpe:2.3:a:twiki:twiki:2004-09-04:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FFA8E461-0CAA-4B44-8BCC-21CD8E1A6A41"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}