Join our followers
Multiple XSS in KnowledgeTree Community Edition
| Advisory ID: | HTB23065 |
| Product: | KnowledgeTree Commercial and Community Editions |
| Vendor: | KnowledgeTree Inc. |
| Vulnerable Versions: | 3.7.0.2 and probably prior |
| Tested Version: | 3.7.0.2 |
| Advisory Publication: | December 21, 2011 [without technical details] |
| Vendor Notification: | December 21, 2011 |
| Vendor Fix: | December 23, 2011 |
| Public Disclosure: | January 11, 2012 |
| Vulnerability Type: | Cross-Site Scripting [CWE-79] |
| CVE Reference: | CVE-2012-0988 |
| Risk Level: | Medium |
 | |
| CVSSv2 Base Score: | 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N) |
| Solution Status: | Fixed by Vendor |
| Discovered and Provided: | High-Tech Bridge Security Research Lab |
| Advisory Details: | |
High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in KnowledgeTree Community Edition, which can be exploited to perform cross-site scripting attacks. | |
| Solution: | |
| Apply Vendor patch: http://www.knowledgetree.org/Security_advisory:_URL_Manipulation | |
References: | |
| [1] High-Tech Bridge Advisory HTB23065 - https://www.immuniweb.com/advisory/HTB23065 - Multiple XSS in KnowledgeTree Community Edition [2] KnowledgeTree Community Edition - knowledgetree.org - KnowledgeTree Community Edition is an open source edition of the KnowledgeTree document management application licensed under the GNU GPL version 3. [3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures. [4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types. | |
Please feel free to send us any additional information related to this Advisory, such as vulnerable versions, additional exploitation details and conditions, patches and other relevant details.
