SB2015010804 - Cross-site scripting in RedCloth
Published: January 8, 2015 Updated: September 13, 2023
Security Bulletin ID
SB2015010804
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Cross-site scripting (CVE-ID: CVE-2012-6684)
Vulnerability allows a remote attacker to perform XSS attacks.
The vulnerability is caused by an input validation error when parsing javascript: URI. A remote attacker can pass specially crafted input to the application and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
Remediation
Install update from vendor's website.