STG Security Advisory: [SSA-20041122-12] Zwiki XSS vulnerability Revision 1.1 Date Published: 2004-11-22 (KST) Last Update: 2004-11-22 Disclosed by SSR Team (advisory@xxxxxxxxxxxxxxx) Summary ======== Zwiki is a wiki clone in zope. It has a cross site scripting vulnerability. Vulnerability Class =================== Implementation Error: Input validation flaw Details ======= Due to an input validation flaw, the Zwiki is vulnerable to cross site scripting attacks. cf. http://zwiki.org/925ZwikiXSSVulnerability proof of concept http://[victim]/<img src=javascript:alert('hi')> Impact ====== Medium: Malicious attackers can inject and execute arbitrary script code in a user's browser session in context of an affected site. Workaround ========== There is no known workaround at this time. Affected Products ================ Zwiki 0.36.2 and prior Vendor Status: NOT FIXED ======================= 2004-10-01 Vulnerability found. 2004-10-01 Zwiki developer notified. 2004-11-22 Official release. Credits ====== Jeremy Bae at STG Security
