|
|
Info |
Last Modified |
| 6 months ago |
|
|
|
|
Description |
Claroline contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'file' variable upon submission to the rqmkhtml.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity. Additionally, this can be used to disclose the software installation path. While such information is relatively low risk, it is often useful in carrying out additional, more focused attacks.
|
|
Classification |
Location:
Remote/Network Access Required
Attack Type:
Input Manipulation
Impact:
Loss of Integrity
Exploit:
Exploit Available
OSVDB:
Web Related
|
|
Solution |
Currently, there are no known workarounds or upgrades to correct this issue. However, Claroline has released a patch to address this vulnerability.
|
|
Products |
|
Claroline
 |
1.7.4 |
|
|
|
|
|
|
|
Credit |
- rgod - rgod
 autistici.org - http://retrogod.altervista.org
|
|
BlogsProvided by Technorati
|
None found at this time
|
|
|
