CVEvulnerability
CVE-2011-3979
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2011-10-04
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Cross-site scripting (XSS) vulnerability in ztemp/view_compiled/Theme/theme_admin_setasdefault.php in the theme module in Zikula Application Framework 1.3.0 build 3168, 1.2.7, and probably other versions allows remote attackers to inject arbitrary web script or HTML via the themename parameter in the setasdefault action to index.php.
Affected configurations
• zikula zikula application framework 1.2.7
• zikula zikula application framework 1.3.0
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://community.zikula.org/index.php?module=News&func=display&sid=3075 Patch
- http://osvdb.org/75226 osvdb.org
- http://secunia.com/advisories/45884 Vendor Advisory
- http://securityreason.com/securityalert/8409 securityreason.com
- http://www.securityfocus.com/archive/1/519565/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/49491 Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/69644 exchange.xforce.ibmcloud.com
- https://www.htbridge.ch/advisory/xss_in_zikula.html Exploit
- http://community.zikula.org/index.php?module=News&func=display&sid=3075 Patch
- http://osvdb.org/75226 osvdb.org
- http://secunia.com/advisories/45884 Vendor Advisory
- http://securityreason.com/securityalert/8409 securityreason.com
- http://www.securityfocus.com/archive/1/519565/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/49491 Exploit
- https://exchange.xforce.ibmcloud.com/vulnerabilities/69644 exchange.xforce.ibmcloud.com
- https://www.htbridge.ch/advisory/xss_in_zikula.html Exploit