4.3

CVE-2011-4616

Exploit
Cross-site scripting (XSS) vulnerability in the HTML-Template-Pro module before 0.9507 for Perl allows remote attackers to inject arbitrary web script or HTML via template parameters, related to improper handling of > (greater than) and < (less than) characters.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Igor Vlasenko ≫ Html-template-pro Version <= 0.9506
Igor Vlasenko ≫ Html-template-pro Version 0.01
Igor Vlasenko ≫ Html-template-pro Version 0.17
Igor Vlasenko ≫ Html-template-pro Version 0.26
Igor Vlasenko ≫ Html-template-pro Version 0.34
Igor Vlasenko ≫ Html-template-pro Version 0.35
Igor Vlasenko ≫ Html-template-pro Version 0.36
Igor Vlasenko ≫ Html-template-pro Version 0.37
Igor Vlasenko ≫ Html-template-pro Version 0.38
Igor Vlasenko ≫ Html-template-pro Version 0.40
Igor Vlasenko ≫ Html-template-pro Version 0.41
Igor Vlasenko ≫ Html-template-pro Version 0.42
Igor Vlasenko ≫ Html-template-pro Version 0.43
Igor Vlasenko ≫ Html-template-pro Version 0.44
Igor Vlasenko ≫ Html-template-pro Version 0.45
Igor Vlasenko ≫ Html-template-pro Version 0.47
Igor Vlasenko ≫ Html-template-pro Version 0.48
Igor Vlasenko ≫ Html-template-pro Version 0.50
Igor Vlasenko ≫ Html-template-pro Version 0.51
Igor Vlasenko ≫ Html-template-pro Version 0.52
Igor Vlasenko ≫ Html-template-pro Version 0.53
Igor Vlasenko ≫ Html-template-pro Version 0.54
Igor Vlasenko ≫ Html-template-pro Version 0.55
Igor Vlasenko ≫ Html-template-pro Version 0.56
Igor Vlasenko ≫ Html-template-pro Version 0.57
Igor Vlasenko ≫ Html-template-pro Version 0.58
Igor Vlasenko ≫ Html-template-pro Version 0.59
Igor Vlasenko ≫ Html-template-pro Version 0.61
Igor Vlasenko ≫ Html-template-pro Version 0.62
Igor Vlasenko ≫ Html-template-pro Version 0.63
Igor Vlasenko ≫ Html-template-pro Version 0.64
Igor Vlasenko ≫ Html-template-pro Version 0.65
Igor Vlasenko ≫ Html-template-pro Version 0.66
Igor Vlasenko ≫ Html-template-pro Version 0.67
Igor Vlasenko ≫ Html-template-pro Version 0.68
Igor Vlasenko ≫ Html-template-pro Version 0.69
Igor Vlasenko ≫ Html-template-pro Version 0.70
Igor Vlasenko ≫ Html-template-pro Version 0.71
Igor Vlasenko ≫ Html-template-pro Version 0.72
Igor Vlasenko ≫ Html-template-pro Version 0.73
Igor Vlasenko ≫ Html-template-pro Version 0.74
Igor Vlasenko ≫ Html-template-pro Version 0.75
Igor Vlasenko ≫ Html-template-pro Version 0.76
Igor Vlasenko ≫ Html-template-pro Version 0.77
Igor Vlasenko ≫ Html-template-pro Version 0.80
Igor Vlasenko ≫ Html-template-pro Version 0.81
Igor Vlasenko ≫ Html-template-pro Version 0.82
Igor Vlasenko ≫ Html-template-pro Version 0.83
Igor Vlasenko ≫ Html-template-pro Version 0.84
Igor Vlasenko ≫ Html-template-pro Version 0.85
Igor Vlasenko ≫ Html-template-pro Version 0.86
Igor Vlasenko ≫ Html-template-pro Version 0.87
Igor Vlasenko ≫ Html-template-pro Version 0.90
Igor Vlasenko ≫ Html-template-pro Version 0.92
Igor Vlasenko ≫ Html-template-pro Version 0.93
Igor Vlasenko ≫ Html-template-pro Version 0.94
Igor Vlasenko ≫ Html-template-pro Version 0.95
Igor Vlasenko ≫ Html-template-pro Version 0.9501
Igor Vlasenko ≫ Html-template-pro Version 0.9502
Igor Vlasenko ≫ Html-template-pro Version 0.9503
Igor Vlasenko ≫ Html-template-pro Version 0.9504
Igor Vlasenko ≫ Html-template-pro Version 0.9505
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.68% 0.74
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=652587
Exploit
http://cpansearch.perl.org/src/VIY/HTML-Template-Pro-0.9507/Changes
http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089603.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089888.html
http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089889.html
http://metacpan.org/diff/release/VIY/HTML-Template-Pro-0.9505/VIY/HTML-Template-Pro-0.9507
http://openwall.com/lists/oss-security/2011/12/19/1
Exploit
http://secunia.com/advisories/47184
Vendor Advisory
http://www.securityfocus.com/bid/51117