[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <4F5E726C.1060408@rolandgruber.de>
Date: Mon, 12 Mar 2012 23:02:20 +0100
From: Roland Gruber <post@...andgruber.de>
To: Jan Lieskovsky <jlieskov@...hat.com>
CC: oss-security@...ts.openwall.com,
"Steven M. Christey" <coley@...us.mitre.org>,
Fabio Tranchitella <kobold@...ian.org>,
Dmitry Butskoy <Dmitry@...skoy.name>
Subject: Re: CVE Request -- LDAP Account Manager Pro / PhpLDAPadmin
-- Multiple XSS flaws
Hi all,
On 12.03.2012 12:18, Jan Lieskovsky wrote:
> Can we consider the CVE-2012-1114, CVE-2012-1115
> identifiers below to be valid also for phpLDAPAdmin code?
yes.
> Roland, could you clarify, if phpLDAPAdmin code would be vulnerable
> to all issues listed for LDAP Account Manager too or if phpLDAPAdmin
> would be vulnerable only for XSS issues when processing:
> i) 'export',
> ii) 'add_value_form'
> iii) and 'dn' variables?
phpLDAPadmin is vulnerable to i, ii and iii.
> And LDAP Account Manager would be vulnerable yet to additional
> XSS flaws, due improper sanitization of 'filteruid', 'type',
> and 'cmd' variables? (and these would be LDAP Account Manager
> specific)
Regarding the filteruid problem I cannot reproduce this. The variable is properly sanitized.
This is a LAM only thing.
--
Best regards
Roland
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
