CVE-2011-3361 Cross-site scripting (XSS) vulnerability in CGI/Browse.pm in BackupPC 3.2.0 and possibly other versions before 3.2.1 allows remote attackers to inject arbitrary web script or HTML via the num paramete...
MediumCVSS 4.3
EPSS 2.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in CGI/Browse.pm in BackupPC 3.2.0 and possibly other versions before 3.2.1 allows remote attackers to inject arbitrary web script or HTML via the num parameter in a browse action to index.cgi.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/backuppc(Debian:12) | < 3.2.1-2 | 3.2.1-2 |
| debian/backuppc(Debian:13) | < 3.2.1-2 | 3.2.1-2 |
| debian/backuppc(Debian:14) | < 3.2.1-2 | 3.2.1-2 |
| backuppc | = 3.2.0 | No fix listed |
References
- Debian Security Tracker CVE-2011-3361 vendor-advisory
- backuppc.cvs.sourceforge.net
- backuppc.cvs.sourceforge.net
- 44259 third-party-advisory vendor-advisory
- 46621 third-party-advisory vendor-advisory
- [BackupPC-devel] 20110118 XSS's in Browse.pm exploit mailing-list
- USN-1249-1 vendor-advisory
- [oss-security] 20110913 CVE Request: BackupPC 3.2.1 fixes cross site scripting mailing-list
- [oss-security] 20110914 Re: CVE Request: BackupPC 3.2.1 fixes cross site scripting mailing-list
- 50406 vdb-entry
- backuppc-num-xss(71030) vdb-entry
- www.htbridge.ch exploit
- bugs.debian.org issue-tracking