VaultWiki 4 Alpha 4 - Security Patch

Earlier today one of our site users stumbled upon a potential cross-site scripting vulnerability in VaultWiki 4 Alpha 3 while using our web site. It's likely the user was unaware of the significance of what they had found: the action was not malicious and conditions were not ideal to perform an exploit, but the problem was obvious to site admins. Minutes later, developers discovered a bug that under specific wiki configurations could be exploited to post arbitrary HTML on a victim's site.

The release of VaultWiki 4 Alpha 4 has been accelerated and made available today to address this issue. We highly recommend that any customers who are using an earlier Alpha of VaultWiki 4 to upgrade as soon as they are able to close this security hole. The issue does not exist in VaultWiki 3.

Please note that Alpha 4, like those before it, is only compatible with vBulletin 4.1.4 and higher.

Changes

In this Alpha, you'll notice:

• Resolved XSS vulnerability
• Forum headers are back
• More reliable caches
• Deleting wiki pages works properly
• Discussion titles are fixed
• Other minor enhancements and bug fixes

Since this is still an Alpha release, we still do not recommend installing VaultWiki 4 Alpha 4 on production sites at this time.