CVEvulnerability
CVE-2012-1004
2.1 LOW
Official page ↗
- Status
- Modified
- Published
- 2012-02-08
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 2.1 LOW — AV:N/AC:H/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Multiple cross-site scripting (XSS) vulnerabilities in UI/Register.pm in Foswiki before 1.1.5 allow remote authenticated users with CHANGE privileges to inject arbitrary web script or HTML via the (1) text, (2) FirstName, (3) LastName, (4) OrganisationName, (5) OrganisationUrl, (6) Profession, (7) Country, (8) State, (9) Address, (10) Location, (11) Telephone, (12) VoIP, (13) InstantMessagingIM, (14) Email, (15) HomePage, or (16) Comment parameter. NOTE: some of these details are obtained from third party information.
Affected configurations
• foswiki foswiki 1.1.0
• foswiki foswiki 1.1.1
• foswiki foswiki 1.1.2
• foswiki foswiki 1.1.3
• foswiki foswiki 1.1.4
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://foswiki.org/Support/SecurityAlert-CVE-2012-1004 Vendor Advisory
- http://foswiki.org/Tasks/Item11498 foswiki.org
- http://foswiki.org/Tasks/Item11501 foswiki.org
- http://secunia.com/advisories/47849 Vendor Advisory
- http://st2tea.blogspot.com/2012/02/foswiki-cross-site-scripting.html st2tea.blogspot.com
- http://foswiki.org/Support/SecurityAlert-CVE-2012-1004 Vendor Advisory
- http://foswiki.org/Tasks/Item11498 foswiki.org
- http://foswiki.org/Tasks/Item11501 foswiki.org
- http://secunia.com/advisories/47849 Vendor Advisory
- http://st2tea.blogspot.com/2012/02/foswiki-cross-site-scripting.html st2tea.blogspot.com