CVE-2010-2479 HTML Purifier Cross-site Scripting (XSS) vulnerability
MediumCVSS 4.3
EPSS 2.0%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
Cross-site scripting (XSS) vulnerability in HTML Purifier before 4.1.1, as used in Mahara and other products, when the browser is Internet Explorer, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ezyang/htmlpurifier(Packagist) | < 4.1.1 | 4.1.1 |
| debian/php-htmlpurifier(Debian:12) | < 4.1.1+dfsg1-1 | 4.1.1+dfsg1-1 |
| debian/php-htmlpurifier(Debian:14) | < 4.1.1+dfsg1-1 | 4.1.1+dfsg1-1 |
| htmlpurifier | <= 4.1.0 | No fix listed |
| htmlpurifier | = 1.0.0 | No fix listed |
| htmlpurifier | = 1.0.0-beta | No fix listed |
| htmlpurifier | = 1.0.1 | No fix listed |
| htmlpurifier | = 1.1.0 | No fix listed |
| htmlpurifier | = 1.1.1 | No fix listed |
| htmlpurifier | = 1.1.2 | No fix listed |
| htmlpurifier | = 1.2.0 | No fix listed |
| htmlpurifier | = 1.3.0 | No fix listed |
| htmlpurifier | = 1.3.1 | No fix listed |
| htmlpurifier | = 1.3.2 | No fix listed |
| htmlpurifier | = 1.4.0 | No fix listed |
| htmlpurifier | = 1.4.1 | No fix listed |
| htmlpurifier | = 1.5.0 | No fix listed |
| htmlpurifier | = 1.6.0 | No fix listed |
| htmlpurifier | = 1.6.1 | No fix listed |
| htmlpurifier | = 2.0.0 | No fix listed |
| htmlpurifier | = 2.0.1 | No fix listed |
| htmlpurifier | = 2.1.0 | No fix listed |
| htmlpurifier | = 2.1.1 | No fix listed |
| htmlpurifier | = 2.1.2 | No fix listed |
| htmlpurifier | = 2.1.3 | No fix listed |
Show 63 more
| Product | Affected versions | Fixed in |
|---|---|---|
| htmlpurifier | = 2.1.4 | No fix listed |
| htmlpurifier | = 2.1.5 | No fix listed |
| htmlpurifier | = 3.0.0 | No fix listed |
| htmlpurifier | = 3.1.0 | No fix listed |
| htmlpurifier | = 3.1.0-rc1 | No fix listed |
| htmlpurifier | = 3.1.1 | No fix listed |
| htmlpurifier | = 3.2.0 | No fix listed |
| htmlpurifier | = 3.3.0 | No fix listed |
| htmlpurifier | = 4.0.0 | No fix listed |
| mahara | <= 1.0.14 | No fix listed |
| mahara | = 0.9.0 | No fix listed |
| mahara | = 0.9.1 | No fix listed |
| mahara | = 0.9.2 | No fix listed |
| mahara | = 1.0.0 | No fix listed |
| mahara | = 1.0.1 | No fix listed |
| mahara | = 1.0.2 | No fix listed |
| mahara | = 1.0.3 | No fix listed |
| mahara | = 1.0.4 | No fix listed |
| mahara | = 1.0.5 | No fix listed |
| mahara | = 1.0.6 | No fix listed |
| mahara | = 1.0.7 | No fix listed |
| mahara | = 1.0.8 | No fix listed |
| mahara | = 1.0.9 | No fix listed |
| mahara | = 1.0.10 | No fix listed |
| mahara | = 1.0.11 | No fix listed |
| mahara | = 1.0.12 | No fix listed |
| mahara | = 1.0.13 | No fix listed |
| mahara | = 1.1.0 | No fix listed |
| mahara | = 1.1.0-alpha1 | No fix listed |
| mahara | = 1.1.0-alpha2 | No fix listed |
| mahara | = 1.1.0-alpha3 | No fix listed |
| mahara | = 1.1.0-beta1 | No fix listed |
| mahara | = 1.1.0-beta2 | No fix listed |
| mahara | = 1.1.0-beta3 | No fix listed |
| mahara | = 1.1.0-beta4 | No fix listed |
| mahara | = 1.1.0-rc1 | No fix listed |
| mahara | = 1.1.0-rc2 | No fix listed |
| mahara | = 1.1.1 | No fix listed |
| mahara | = 1.1.2 | No fix listed |
| mahara | = 1.1.3 | No fix listed |
| mahara | = 1.1.4 | No fix listed |
| mahara | = 1.1.5 | No fix listed |
| mahara | = 1.1.6 | No fix listed |
| mahara | = 1.1.7 | No fix listed |
| mahara | = 1.1.8 | No fix listed |
| mahara | = 1.2.0 | No fix listed |
| mahara | = 1.2.0-alpha1 | No fix listed |
| mahara | = 1.2.0-alpha2 | No fix listed |
| mahara | = 1.2.0-alpha3 | No fix listed |
| mahara | = 1.2.0-beta1 | No fix listed |
| mahara | = 1.2.0-beta2 | No fix listed |
| mahara | = 1.2.0-beta3 | No fix listed |
| mahara | = 1.2.0-beta4 | No fix listed |
| mahara | = 1.2.0-rc1 | No fix listed |
| mahara | = 1.2.1 | No fix listed |
| mahara | = 1.2.2 | No fix listed |
| mahara | = 1.2.3 | No fix listed |
| mahara | = 1.2.4 | No fix listed |
| debian/php-htmlpurifier(Debian:14) | = 3.3.0-1 | No fix listed |
| debian/php-htmlpurifier(Debian:14) | = 4.0.0+dfsg1-1 | No fix listed |
| debian/php-htmlpurifier(Debian:14) | = 4.0.0-1 | No fix listed |
| debian/php-htmlpurifier(Debian:14) | = 4.0.0-2 | No fix listed |
| debian/php-htmlpurifier(Debian:14) | = 4.1.0+dfsg1-1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com exploit
- github.com product
- htmlpurifier.org patch
- repo.or.cz
- 39613 third-party-advisory vendor-advisory
- 40431 third-party-advisory vendor-advisory
- wiki.mahara.org
- wiki.mahara.org
- wiki.mahara.org
- 41259 patch vdb-entry
- Debian Security Tracker CVE-2010-2479 vendor-advisory
- github.com