Description
Cross-site scripting (XSS) vulnerability in RestoreFile.pm in BackupPC 3.1.0, 3.2.1, and possibly other earlier versions allows remote attackers to inject arbitrary web script or HTML via the share parameter in a RestoreFile action to index.cgi.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | backuppc | 3.1.0-9.1 | — |
| Debian 13 | backuppc | 3.1.0-9.1 | — |
| Debian 12 | backuppc | 3.1.0-9.1 | — |
References
- 20110428 HTB22965: Multiple XSS vulnerabilities in BackupPC mailing-list
- https://www.htbridge.ch/advisory/multiple_xss_vulnerabilities_in_backuppc.html
- 72055 vdb-entry
- backuppc-index-xss(67170) vdb-entry
- 44385 third-party-advisory