Unscored CVE-2014-9325 EUVD-2014-9150GHSA-f29g-f7p5-49vf

Multiple cross-site scripting (XSS) vulnerabilities in TWiki 6.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1…

Published Dec 31, 2014 · Updated Aug 6, 2024 · Assigned by mitre

Description

Multiple cross-site scripting (XSS) vulnerabilities in TWiki 6.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) QUERYSTRING variable in lib/TWiki.pm or (2) QUERYPARAMSTRING variable in lib/TWiki/UI/View.pm, as demonstrated by the QUERY_STRING to do/view/Main/TWikiPreferences.

References

20141219 TWiki Security Alert CVE-2014-9325: XSS Vulnerability with QUERYSTRING and QUERYPARAMSTRING Variables mailing-list
http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2014-9325
1031399 vdb-entry
http://packetstormsecurity.com/files/129654/TWiki-6.0.1-QUERYSTRING-QUERYPARAMSTRING-XSS.html