CVE-2011-1671 Cross-site scripting (XSS) vulnerability in app/controllers/todos_controller.rb in Tracks 1.7.2, 2.0RC2, and 2.0devel allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO t...
MediumCVSS 4.3
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in app/controllers/todos_controller.rb in Tracks 1.7.2, 2.0RC2, and 2.0devel allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to todos/tag/. NOTE: some of these details are obtained from third party information.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| getontracks tracks | = 1.7.2 | No fix listed |
| getontracks tracks | = 2.0-devel | No fix listed |
| getontracks tracks | = 2.0-rc2 | No fix listed |
References
- 71352 exploit vdb-entry
- 43909 third-party-advisory vendor-advisory
- 8196 third-party-advisory
- www.getontracks.org patch
- www.mavitunasecurity.com exploit
- 20110329 XSS Vulnerability in Tracks 1.7.2 mailing-list
- 47078 exploit vdb-entry
- tracks-todoscontroller-xss(66561) vdb-entry