CVE-2011-0728 Loggerhead XSS via filename
LowCVSS 3.5
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in templatefunctions.py in Loggerhead before 1.18.1 allows remote authenticated users to inject arbitrary web script or HTML via a filename, which is not properly handled in a revision view.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi loggerhead(PyPI) | < 1.18.1 | 1.18.1 |
| michael hudson-doyle loggerhead | <= 1.18 | No fix listed |
| michael hudson-doyle loggerhead | = 1.6 | No fix listed |
| michael hudson-doyle loggerhead | = 1.6.1 | No fix listed |
| michael hudson-doyle loggerhead | = 1.10 | No fix listed |
| michael hudson-doyle loggerhead | = 1.17 | No fix listed |
| debian/loggerhead(Debian:12) | < 1.18.1-1 | 1.18.1-1 |
| debian/loggerhead(Debian:13) | < 1.18.1-1 | 1.18.1-1 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- bugs.launchpad.net patch
- loggerhead-filename-xss(66305) vdb-entry
- launchpad.net patch
- web.archive.org
- FEDORA-2011-4050 vendor-advisory
- FEDORA-2011-4085 vendor-advisory
- FEDORA-2011-4107 vendor-advisory
- pypi.org product
- github.com vendor-advisory
- 43822 third-party-advisory vendor-advisory
- 44017 third-party-advisory
- 71279 vdb-entry
- 47032 vdb-entry
- ADV-2011-0848 vdb-entry
- ADV-2011-0849 vdb-entry
- Debian Security Tracker CVE-2011-0728 vendor-advisory