vendor:
Diigo Toolbar and Diigolet
by:
SecurityFocus
7.5
CVSS
HIGH
HTML-injection and Information-disclosure
79
CWE
Product Name: Diigo Toolbar and Diigolet
Affected Version From: N/A
Affected Version To: N/A
Patch Exists: Yes
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2008
Diigo Toolbar and Diigolet HTML-injection and Information-disclosure Vulnerabilities
Diigo Toolbar and Diigolet are prone to an HTML-injection vulnerability and an information-disclosure vulnerability when handling data via the 'comment' feature. An attacker can exploit the HTML-injection issue to run arbitrary HTML and script code in the plugin of an unsuspecting user in the context of the domain on which a shared comment was made. This may help the attacker steal cookie-based authentication credentials and launch other attacks. The attacker can exploit the information-disclosure issue via successful man-in-the-middle attacks. Information harvested may aid in further attacks.
Mitigation:
Ensure that all Diigo Toolbar and Diigolet components are up to date.
