Affects all platforms supported by the vulnerable versions.
Description
HTML/Javascript injection. A malicious user can craft a malicious query string that, when present in the server's REQUEST_URI, can be included in an article's footnote links unencoded.
Discovered
~June 3, 2010
Resolved
June 7, 2010
Patches Available
3.0.0
The versions listed below are known to be affected by this issue. If you are using one of those versions, you should update to a newer release that has no known vulnerabilities.
Notes
When the patch was originally released, it was believed that the issue only affected VaultWiki 3.x versions, because the affected code appeared to be sufficiently different from 2.x versions. However, the underlying logic, although coded differently, was still present in 2.x, so it remained unpatched until the end-of-life of that series.
This site uses cookies to help personalize content, to tailor your experience, and to keep you logged in if you register.
By continuing to use this site, you are consenting to our use of cookies.
