CVE-2011-1401

Current Description

ikiwiki before 3.20110328 does not ascertain whether the htmlscrubber plugin is enabled during processing of the "meta stylesheet" directive, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences in (1) the default stylesheet or (2) an alternate stylesheet.

Basic Data

PublishedApril 11, 2011
Last ModifiedApril 20, 2011
Assignercve@mitre.org
Data TypeCVE
Data FormatMITRE
Data Version4.0
Problem TypeCWE-79
CVE Data Version4.0

Base Metric V2

CVSS 2 - Version2.0
CVSS 2 - Vector StringAV:N/AC:M/Au:S/C:N/I:P/A:N
CVSS 2 - Access VectorNETWORK
CVSS 2 - Access ComplexityMEDIUM
CVSS 2 - AuthenticationSINGLE
CVSS 2 - Confidentiality ImpactNONE
CVSS 2 - Availability ImpactNONE
CVSS 2 - Base Score3.5
SeverityLOW
Exploitability Score6.8
Impact Score2.9
Obtain All Privilegefalse
Obtain User Privilegefalse
Obtain Other Privilegefalse

Base Metric V3

No data provided.

Configurations

  • OR - Configuration 1
    Cpe VersionPartVendorProductVersionUpdateEditionLanguageSW EditionTarget SWTarget HWOtherVersion Start IncludingVersion End IncludingVersion Start ExcludingVersion End Excluding
    2.3ApplicationIkiwikiIkiwiki1.0*******
    2.3ApplicationIkiwikiIkiwiki1.1*******
    2.3ApplicationIkiwikiIkiwiki1.1.47*******
    2.3ApplicationIkiwikiIkiwiki1.2*******
    2.3ApplicationIkiwikiIkiwiki1.3*******
    2.3ApplicationIkiwikiIkiwiki1.4*******
    2.3ApplicationIkiwikiIkiwiki1.5*******
    2.3ApplicationIkiwikiIkiwiki1.6*******
    2.3ApplicationIkiwikiIkiwiki1.7*******
    2.3ApplicationIkiwikiIkiwiki1.8*******
    2.3ApplicationIkiwikiIkiwiki1.9*******
    2.3ApplicationIkiwikiIkiwiki1.10*******
    2.3ApplicationIkiwikiIkiwiki1.11*******
    2.3ApplicationIkiwikiIkiwiki1.12*******
    2.3ApplicationIkiwikiIkiwiki1.13*******
    2.3ApplicationIkiwikiIkiwiki1.14*******
    2.3ApplicationIkiwikiIkiwiki1.15*******
    2.3ApplicationIkiwikiIkiwiki1.16*******
    2.3ApplicationIkiwikiIkiwiki1.17*******
    2.3ApplicationIkiwikiIkiwiki1.18*******
    2.3ApplicationIkiwikiIkiwiki1.19*******
    2.3ApplicationIkiwikiIkiwiki1.20*******
    2.3ApplicationIkiwikiIkiwiki1.21*******
    2.3ApplicationIkiwikiIkiwiki1.22*******
    2.3ApplicationIkiwikiIkiwiki1.23*******
    2.3ApplicationIkiwikiIkiwiki1.24*******
    2.3ApplicationIkiwikiIkiwiki1.25*******
    2.3ApplicationIkiwikiIkiwiki1.26*******
    2.3ApplicationIkiwikiIkiwiki1.27*******
    2.3ApplicationIkiwikiIkiwiki1.28*******
    2.3ApplicationIkiwikiIkiwiki1.29*******
    2.3ApplicationIkiwikiIkiwiki1.30*******
    2.3ApplicationIkiwikiIkiwiki1.31*******
    2.3ApplicationIkiwikiIkiwiki1.32*******
    2.3ApplicationIkiwikiIkiwiki1.33.3*******
    2.3ApplicationIkiwikiIkiwiki1.34*******
    2.3ApplicationIkiwikiIkiwiki1.34.1*******
    2.3ApplicationIkiwikiIkiwiki1.34.2*******
    2.3ApplicationIkiwikiIkiwiki1.35*******
    2.3ApplicationIkiwikiIkiwiki1.36*******
    2.3ApplicationIkiwikiIkiwiki1.37*******
    2.3ApplicationIkiwikiIkiwiki1.38*******
    2.3ApplicationIkiwikiIkiwiki1.39*******
    2.3ApplicationIkiwikiIkiwiki1.40*******
    2.3ApplicationIkiwikiIkiwiki1.41*******
    2.3ApplicationIkiwikiIkiwiki1.42*******
    2.3ApplicationIkiwikiIkiwiki1.43*******
    2.3ApplicationIkiwikiIkiwiki1.44*******
    2.3ApplicationIkiwikiIkiwiki1.45*******
    2.3ApplicationIkiwikiIkiwiki1.46*******
    2.3ApplicationIkiwikiIkiwiki1.47*******
    2.3ApplicationIkiwikiIkiwiki1.48*******
    2.3ApplicationIkiwikiIkiwiki1.49*******
    2.3ApplicationIkiwikiIkiwiki1.50*******
    2.3ApplicationIkiwikiIkiwiki1.51*******
    2.3ApplicationIkiwikiIkiwiki2.0*******
    2.3ApplicationIkiwikiIkiwiki2.00*******
    2.3ApplicationIkiwikiIkiwiki2.1*******
    2.3ApplicationIkiwikiIkiwiki2.2*******
    2.3ApplicationIkiwikiIkiwiki2.3*******
    2.3ApplicationIkiwikiIkiwiki2.4*******
    2.3ApplicationIkiwikiIkiwiki2.5*******
    2.3ApplicationIkiwikiIkiwiki2.6*******
    2.3ApplicationIkiwikiIkiwiki2.6.1*******
    2.3ApplicationIkiwikiIkiwiki2.7*******
    2.3ApplicationIkiwikiIkiwiki2.8*******
    2.3ApplicationIkiwikiIkiwiki2.9*******
    2.3ApplicationIkiwikiIkiwiki2.10*******
    2.3ApplicationIkiwikiIkiwiki2.11*******
    2.3ApplicationIkiwikiIkiwiki2.12*******
    2.3ApplicationIkiwikiIkiwiki2.13*******
    2.3ApplicationIkiwikiIkiwiki2.14*******
    2.3ApplicationIkiwikiIkiwiki2.15*******
    2.3ApplicationIkiwikiIkiwiki2.16*******
    2.3ApplicationIkiwikiIkiwiki2.17*******
    2.3ApplicationIkiwikiIkiwiki2.18*******
    2.3ApplicationIkiwikiIkiwiki2.19*******
    2.3ApplicationIkiwikiIkiwiki2.20*******
    2.3ApplicationIkiwikiIkiwiki2.30*******
    2.3ApplicationIkiwikiIkiwiki2.31*******
    2.3ApplicationIkiwikiIkiwiki2.31.1*******
    2.3ApplicationIkiwikiIkiwiki2.31.2*******
    2.3ApplicationIkiwikiIkiwiki2.31.3*******
    2.3ApplicationIkiwikiIkiwiki2.40*******
    2.3ApplicationIkiwikiIkiwiki2.41*******
    2.3ApplicationIkiwikiIkiwiki2.42*******
    2.3ApplicationIkiwikiIkiwiki2.43*******
    2.3ApplicationIkiwikiIkiwiki2.44*******
    2.3ApplicationIkiwikiIkiwiki2.45*******
    2.3ApplicationIkiwikiIkiwiki2.46*******
    2.3ApplicationIkiwikiIkiwiki2.47*******
    2.3ApplicationIkiwikiIkiwiki2.48*******
    2.3ApplicationIkiwikiIkiwiki2.49*******
    2.3ApplicationIkiwikiIkiwiki2.50*******
    2.3ApplicationIkiwikiIkiwiki2.51*******
    2.3ApplicationIkiwikiIkiwiki2.52*******
    2.3ApplicationIkiwikiIkiwiki2.53*******
    2.3ApplicationIkiwikiIkiwiki2.54*******
    2.3ApplicationIkiwikiIkiwiki2.55*******
    2.3ApplicationIkiwikiIkiwiki2.56*******
    2.3ApplicationIkiwikiIkiwiki2.60*******
    2.3ApplicationIkiwikiIkiwiki2.61*******
    2.3ApplicationIkiwikiIkiwiki2.62*******
    2.3ApplicationIkiwikiIkiwiki2.62.1*******
    2.3ApplicationIkiwikiIkiwiki2.63*******
    2.3ApplicationIkiwikiIkiwiki2.64*******
    2.3ApplicationIkiwikiIkiwiki2.65*******
    2.3ApplicationIkiwikiIkiwiki2.66*******
    2.3ApplicationIkiwikiIkiwiki2.67*******
    2.3ApplicationIkiwikiIkiwiki2.68*******
    2.3ApplicationIkiwikiIkiwiki2.69*******
    2.3ApplicationIkiwikiIkiwiki2.70*******
    2.3ApplicationIkiwikiIkiwiki2.71*******
    2.3ApplicationIkiwikiIkiwiki2.72*******
    2.3ApplicationIkiwikiIkiwiki3.0*******
    2.3ApplicationIkiwikiIkiwiki3.00*******
    2.3ApplicationIkiwikiIkiwiki3.01*******
    2.3ApplicationIkiwikiIkiwiki3.02*******
    2.3ApplicationIkiwikiIkiwiki3.03*******
    2.3ApplicationIkiwikiIkiwiki3.04*******
    2.3ApplicationIkiwikiIkiwiki3.05*******
    2.3ApplicationIkiwikiIkiwiki3.06*******
    2.3ApplicationIkiwikiIkiwiki3.07*******
    2.3ApplicationIkiwikiIkiwiki3.08*******
    2.3ApplicationIkiwikiIkiwiki3.09*******
    2.3ApplicationIkiwikiIkiwiki3.10*******
    2.3ApplicationIkiwikiIkiwiki3.11*******
    2.3ApplicationIkiwikiIkiwiki3.12*******
    2.3ApplicationIkiwikiIkiwiki3.13*******
    2.3ApplicationIkiwikiIkiwiki3.14*******
    2.3ApplicationIkiwikiIkiwiki3.141*******
    2.3ApplicationIkiwikiIkiwiki3.1415*******
    2.3ApplicationIkiwikiIkiwiki3.14159*******
    2.3ApplicationIkiwikiIkiwiki3.141592*******
    2.3ApplicationIkiwikiIkiwiki3.1415926*******
    2.3ApplicationIkiwikiIkiwiki3.14159265*******
    2.3ApplicationIkiwikiIkiwiki3.20091009*******
    2.3ApplicationIkiwikiIkiwiki3.20091017*******
    2.3ApplicationIkiwikiIkiwiki3.20091022*******
    2.3ApplicationIkiwikiIkiwiki3.20091023*******
    2.3ApplicationIkiwikiIkiwiki3.20091031*******
    2.3ApplicationIkiwikiIkiwiki3.20091113*******
    2.3ApplicationIkiwikiIkiwiki3.20091202*******
    2.3ApplicationIkiwikiIkiwiki3.20091218*******
    2.3ApplicationIkiwikiIkiwiki3.20100102.3*******
    2.3ApplicationIkiwikiIkiwiki3.20100122*******
    2.3ApplicationIkiwikiIkiwiki3.20100212*******
    2.3ApplicationIkiwikiIkiwiki3.20100302*******
    2.3ApplicationIkiwikiIkiwiki3.20100312*******
    2.3ApplicationIkiwikiIkiwiki3.20100403*******
    2.3ApplicationIkiwikiIkiwiki3.20100427*******
    2.3ApplicationIkiwikiIkiwiki3.20100501*******
    2.3ApplicationIkiwikiIkiwiki3.20100504*******
    2.3ApplicationIkiwikiIkiwiki3.20100515*******
    2.3ApplicationIkiwikiIkiwiki3.20100518*******
    2.3ApplicationIkiwikiIkiwiki3.20100518.2*******
    2.3ApplicationIkiwikiIkiwiki3.20100610*******
    2.3ApplicationIkiwikiIkiwiki3.20100623*******
    2.3ApplicationIkiwikiIkiwiki3.20100722*******
    2.3ApplicationIkiwikiIkiwiki3.20100804*******
    2.3ApplicationIkiwikiIkiwiki3.20100815*******
    2.3ApplicationIkiwikiIkiwiki3.20100831*******
    2.3ApplicationIkiwikiIkiwiki3.20100926*******
    2.3ApplicationIkiwikiIkiwiki3.20101019*******
    2.3ApplicationIkiwikiIkiwiki3.20101023*******
    2.3ApplicationIkiwikiIkiwiki3.20101112*******
    2.3ApplicationIkiwikiIkiwiki3.20101129*******
    2.3ApplicationIkiwikiIkiwiki3.20101201*******
    2.3ApplicationIkiwikiIkiwiki3.20101231*******
    2.3ApplicationIkiwikiIkiwiki3.20110105*******
    2.3ApplicationIkiwikiIkiwiki3.20110123*******
    2.3ApplicationIkiwikiIkiwiki3.20110124*******
    2.3ApplicationIkiwikiIkiwiki3.20110225*******
    2.3ApplicationIkiwikiIkiwiki********3.20110321

Vulnerable Software List

VendorProductVersions
Ikiwiki Ikiwiki *, 1.0, 1.1, 1.1.47, 1.10, 1.11, 1.12, 1.13, 1.14, 1.15, 1.16, 1.17, 1.18, 1.19, 1.2, 1.20, 1.21, 1.22, 1.23, 1.24, 1.25, 1.26, 1.27, 1.28, 1.29, 1.3, 1.30, 1.31, 1.32, 1.33.3, 1.34, 1.34.1, 1.34.2, 1.35, 1.36, 1.37, 1.38, 1.39, 1.4, 1.40, 1.41, 1.42, 1.43, 1.44, 1.45, 1.46, 1.47, 1.48, 1.49, 1.5, 1.50, 1.51, 1.6, 1.7, 1.8, 1.9, 2.0, 2.00, 2.1, 2.10, 2.11, 2.12, 2.13, 2.14, 2.15, 2.16, 2.17, 2.18, 2.19, 2.2, 2.20, 2.3, 2.30, 2.31, 2.31.1, 2.31.2, 2.31.3, 2.4, 2.40, 2.41, 2.42, 2.43, 2.44, 2.45, 2.46, 2.47, 2.48, 2.49, 2.5, 2.50, 2.51, 2.52, 2.53, 2.54, 2.55, 2.56, 2.6, 2.6.1, 2.60, 2.61, 2.62, 2.62.1, 2.63, 2.64, 2.65, 2.66, 2.67, 2.68, 2.69, 2.7, 2.70, 2.71, 2.72, 2.8, 2.9, 3.0, 3.00, 3.01, 3.02, 3.03, 3.04, 3.05, 3.06, 3.07, 3.08, 3.09, 3.10, 3.11, 3.12, 3.13, 3.14, 3.141, 3.1415, 3.14159, 3.141592, 3.1415926, 3.14159265, 3.20091009, 3.20091017, 3.20091022, 3.20091023, 3.20091031, 3.20091113, 3.20091202, 3.20091218, 3.20100102.3, 3.20100122, 3.20100212, 3.20100302, 3.20100312, 3.20100403, 3.20100427, 3.20100501, 3.20100504, 3.20100515, 3.20100518, 3.20100518.2, 3.20100610, 3.20100623, 3.20100722, 3.20100804, 3.20100815, 3.20100831, 3.20100926, 3.20101019, 3.20101023, 3.20101112, 3.20101129, 3.20101201, 3.20101231, 3.20110105, 3.20110123, 3.20110124, 3.20110225

References

NameSourceURLTags
http://ikiwiki.info/security/#index39h2http://ikiwiki.info/security/#index39h2CONFIRM
FEDORA-2011-5249http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058403.htmlFEDORA
44079http://secunia.com/advisories/44079SECUNIA
44137http://secunia.com/advisories/44137SECUNIA
DSA-2214http://www.debian.org/security/2011/dsa-2214DEBIAN
47285http://www.securityfocus.com/bid/47285BID
ADV-2011-0907http://www.vupen.com/english/advisories/2011/0907VUPEN
ADV-2011-1005http://www.vupen.com/english/advisories/2011/1005VUPEN