vendor:
Elgg
by:
SecurityFocus
7.5
CVSS
HIGH
HTML-injection
79
CWE
Product Name: Elgg
Affected Version From: Elgg 1.0
Affected Version To: Elgg 1.0
Patch Exists: YES
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2010
Elgg HTML-injection Vulnerability
Elgg is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content. Exploits require the attacker be an authenticated user; this permission may be trivial to acquire. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
Mitigation:
Input validation should be used to ensure that untrusted data is not used to generate dynamic content. Additionally, authentication should be used to ensure that only trusted users can access the application.
