4.3

CVE-2010-2479

Cross-site scripting (XSS) vulnerability in HTML Purifier before 4.1.1, as used in Mahara and other products, when the browser is Internet Explorer, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Htmlpurifier ≫ Htmlpurifier Version <= 4.1.0
Htmlpurifier ≫ Htmlpurifier Edition lite Version <= 4.1.0
Htmlpurifier ≫ Htmlpurifier Edition standalone Version <= 4.1.0
Htmlpurifier ≫ Htmlpurifier Version 1.0.0
Htmlpurifier ≫ Htmlpurifier Version 1.0.0 Update beta
Htmlpurifier ≫ Htmlpurifier Version 1.0.1
Htmlpurifier ≫ Htmlpurifier Version 1.1.0
Htmlpurifier ≫ Htmlpurifier Version 1.1.1
Htmlpurifier ≫ Htmlpurifier Version 1.1.2
Htmlpurifier ≫ Htmlpurifier Version 1.2.0
Htmlpurifier ≫ Htmlpurifier Version 1.3.0
Htmlpurifier ≫ Htmlpurifier Version 1.3.1
Htmlpurifier ≫ Htmlpurifier Version 1.3.2
Htmlpurifier ≫ Htmlpurifier Version 1.4.0
Htmlpurifier ≫ Htmlpurifier Version 1.4.0 Edition strict
Htmlpurifier ≫ Htmlpurifier Version 1.4.1
Htmlpurifier ≫ Htmlpurifier Version 1.4.1 Edition strict
Htmlpurifier ≫ Htmlpurifier Version 1.5.0
Htmlpurifier ≫ Htmlpurifier Version 1.5.0 Edition strict
Htmlpurifier ≫ Htmlpurifier Version 1.6.0
Htmlpurifier ≫ Htmlpurifier Version 1.6.0 Edition strict
Htmlpurifier ≫ Htmlpurifier Version 1.6.1
Htmlpurifier ≫ Htmlpurifier Version 1.6.1 Edition strict
Htmlpurifier ≫ Htmlpurifier Version 2.0.0
Htmlpurifier ≫ Htmlpurifier Version 2.0.0 Edition strict
Htmlpurifier ≫ Htmlpurifier Version 2.0.1
Htmlpurifier ≫ Htmlpurifier Version 2.0.1 Edition strict
Htmlpurifier ≫ Htmlpurifier Version 2.1.0
Htmlpurifier ≫ Htmlpurifier Version 2.1.0 Edition lite
Htmlpurifier ≫ Htmlpurifier Version 2.1.0 Edition standalone
Htmlpurifier ≫ Htmlpurifier Version 2.1.0 Edition strict
Htmlpurifier ≫ Htmlpurifier Version 2.1.0 Edition strict-lite
Htmlpurifier ≫ Htmlpurifier Version 2.1.0 Edition strict-standalone
Htmlpurifier ≫ Htmlpurifier Version 2.1.1
Htmlpurifier ≫ Htmlpurifier Version 2.1.1 Edition lite
Htmlpurifier ≫ Htmlpurifier Version 2.1.1 Edition standalone
Htmlpurifier ≫ Htmlpurifier Version 2.1.1 Edition strict
Htmlpurifier ≫ Htmlpurifier Version 2.1.1 Edition strict-lite
Htmlpurifier ≫ Htmlpurifier Version 2.1.1 Edition strict-standalone
Htmlpurifier ≫ Htmlpurifier Version 2.1.2
Htmlpurifier ≫ Htmlpurifier Version 2.1.2 Edition lite
Htmlpurifier ≫ Htmlpurifier Version 2.1.2 Edition standalone
Htmlpurifier ≫ Htmlpurifier Version 2.1.2 Edition strict
Htmlpurifier ≫ Htmlpurifier Version 2.1.2 Edition strict-lite
Htmlpurifier ≫ Htmlpurifier Version 2.1.2 Edition strict-standalone
Htmlpurifier ≫ Htmlpurifier Version 2.1.3
Htmlpurifier ≫ Htmlpurifier Version 2.1.3 Edition lite
Htmlpurifier ≫ Htmlpurifier Version 2.1.3 Edition standalone
Htmlpurifier ≫ Htmlpurifier Version 2.1.3 Edition strict
Htmlpurifier ≫ Htmlpurifier Version 2.1.3 Edition strict-lite
Htmlpurifier ≫ Htmlpurifier Version 2.1.3 Edition strict-standalone
Htmlpurifier ≫ Htmlpurifier Version 2.1.4
Htmlpurifier ≫ Htmlpurifier Version 2.1.4 Edition lite
Htmlpurifier ≫ Htmlpurifier Version 2.1.4 Edition standalone
Htmlpurifier ≫ Htmlpurifier Version 2.1.5
Htmlpurifier ≫ Htmlpurifier Version 2.1.5 Edition lite
Htmlpurifier ≫ Htmlpurifier Version 2.1.5 Edition standalone
Htmlpurifier ≫ Htmlpurifier Version 3.0.0
Htmlpurifier ≫ Htmlpurifier Version 3.0.0 Edition lite
Htmlpurifier ≫ Htmlpurifier Version 3.0.0 Edition standalone
Htmlpurifier ≫ Htmlpurifier Version 3.1.0
Htmlpurifier ≫ Htmlpurifier Version 3.1.0 Edition lite
Htmlpurifier ≫ Htmlpurifier Version 3.1.0 Edition standalone
Htmlpurifier ≫ Htmlpurifier Version 3.1.0 Update rc1
Htmlpurifier ≫ Htmlpurifier Version 3.1.0 Update rc1 Edition lite
Htmlpurifier ≫ Htmlpurifier Version 3.1.0 Update rc1 Edition standalone
Htmlpurifier ≫ Htmlpurifier Version 3.1.1
Htmlpurifier ≫ Htmlpurifier Version 3.1.1 Edition lite
Htmlpurifier ≫ Htmlpurifier Version 3.1.1 Edition standalone
Htmlpurifier ≫ Htmlpurifier Version 3.2.0
Htmlpurifier ≫ Htmlpurifier Version 3.2.0 Edition lite
Htmlpurifier ≫ Htmlpurifier Version 3.2.0 Edition standalone
Htmlpurifier ≫ Htmlpurifier Version 3.3.0
Htmlpurifier ≫ Htmlpurifier Version 3.3.0 Edition lite
Htmlpurifier ≫ Htmlpurifier Version 3.3.0 Edition standalone
Htmlpurifier ≫ Htmlpurifier Version 4.0.0
Htmlpurifier ≫ Htmlpurifier Version 4.0.0 Edition lite
Htmlpurifier ≫ Htmlpurifier Version 4.0.0 Edition standalone
Mahara ≫ Mahara Version <= 1.0.14
Mahara ≫ Mahara Version 0.9.0
Mahara ≫ Mahara Version 0.9.1
Mahara ≫ Mahara Version 0.9.2
Mahara ≫ Mahara Version 1.0.0
Mahara ≫ Mahara Version 1.0.1
Mahara ≫ Mahara Version 1.0.2
Mahara ≫ Mahara Version 1.0.3
Mahara ≫ Mahara Version 1.0.4
Mahara ≫ Mahara Version 1.0.5
Mahara ≫ Mahara Version 1.0.6
Mahara ≫ Mahara Version 1.0.7
Mahara ≫ Mahara Version 1.0.8
Mahara ≫ Mahara Version 1.0.9
Mahara ≫ Mahara Version 1.0.10
Mahara ≫ Mahara Version 1.0.11
Mahara ≫ Mahara Version 1.0.12
Mahara ≫ Mahara Version 1.0.13
Mahara ≫ Mahara Version 1.1.0
Mahara ≫ Mahara Version 1.1.0 Update alpha1
Mahara ≫ Mahara Version 1.1.0 Update alpha2
Mahara ≫ Mahara Version 1.1.0 Update alpha3
Mahara ≫ Mahara Version 1.1.0 Update beta1
Mahara ≫ Mahara Version 1.1.0 Update beta2
Mahara ≫ Mahara Version 1.1.0 Update beta3
Mahara ≫ Mahara Version 1.1.0 Update beta4
Mahara ≫ Mahara Version 1.1.0 Update rc1
Mahara ≫ Mahara Version 1.1.0 Update rc2
Mahara ≫ Mahara Version 1.1.1
Mahara ≫ Mahara Version 1.1.2
Mahara ≫ Mahara Version 1.1.3
Mahara ≫ Mahara Version 1.1.4
Mahara ≫ Mahara Version 1.1.5
Mahara ≫ Mahara Version 1.1.6
Mahara ≫ Mahara Version 1.1.7
Mahara ≫ Mahara Version 1.1.8
Mahara ≫ Mahara Version 1.2.0
Mahara ≫ Mahara Version 1.2.0 Update alpha1
Mahara ≫ Mahara Version 1.2.0 Update alpha2
Mahara ≫ Mahara Version 1.2.0 Update alpha3
Mahara ≫ Mahara Version 1.2.0 Update beta1
Mahara ≫ Mahara Version 1.2.0 Update beta2
Mahara ≫ Mahara Version 1.2.0 Update beta3
Mahara ≫ Mahara Version 1.2.0 Update beta4
Mahara ≫ Mahara Version 1.2.0 Update rc1
Mahara ≫ Mahara Version 1.2.1
Mahara ≫ Mahara Version 1.2.2
Mahara ≫ Mahara Version 1.2.3
Mahara ≫ Mahara Version 1.2.4
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.01% 0.783
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://secunia.com/advisories/40431
Vendor Advisory
http://wiki.mahara.org/Release_Notes/1.0.15
http://wiki.mahara.org/Release_Notes/1.1.9
http://wiki.mahara.org/Release_Notes/1.2.5
http://htmlpurifier.org/news/2010/0531-4.1.1-released
Patch
http://repo.or.cz/w/htmlpurifier.git/commitdiff/18e538317a877a0509ae71a860429c41770da230
http://secunia.com/advisories/39613
Vendor Advisory
http://www.securityfocus.com/bid/41259
Patch