CVE-2011-4923 Cross-site scripting (XSS) vulnerability in View.pm in BackupPC 3.0.0, 3.1.0, 3.2.0, 3.2.1, and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the num parameter in...
MediumCVSS 4.3
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in View.pm in BackupPC 3.0.0, 3.1.0, 3.2.0, 3.2.1, and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the num parameter in a view action to index.cgi, related to the log file viewer, a different vulnerability than CVE-2011-3361.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/backuppc(Debian:12) | < 3.2.1-2 | 3.2.1-2 |
| debian/backuppc(Debian:13) | < 3.2.1-2 | 3.2.1-2 |
| debian/backuppc(Debian:14) | < 3.2.1-2 | 3.2.1-2 |
| backuppc | = 3.0.0 | No fix listed |
| backuppc | = 3.1.0 | No fix listed |
| backuppc | = 3.2.0 | No fix listed |
| backuppc | = 3.2.1 | No fix listed |
References
- Debian Security Tracker CVE-2011-4923 vendor-advisory
- 46615 third-party-advisory vendor-advisory
- USN-1249-1 vendor-advisory
- [oss-security] 20111027 CVE Request: Security issue in backuppc mailing-list
- [oss-security] 20120104 Re: CVE Request: Security issue in backuppc mailing-list
- 50406 vdb-entry
- backuppc-num-xss(71030) vdb-entry
- bugs.debian.org issue-tracking