XSS Vulnerability in Elgg by Curverider
CVE-2011-2935

6.1MEDIUM

Key Information:

Vendor

Elgg

Status
Elgg
Vendor
CVE Published:
12 November 2019

What is CVE-2011-2935?

Elgg versions up to 1.7.10 are subject to a Cross-Site Scripting (XSS) vulnerability that could allow an attacker to inject malicious scripts into a user's session. Exploiting this vulnerability may lead to unauthorized access to sensitive user data and the potential for session hijacking. It is crucial for users of affected versions to apply updates or patches provided by the vendor to ensure the integrity of their applications.

Affected Version(s)

Elgg through 1.7.10

References

https://security-tracker.debian.org/tracker/CVE-2011-2935
vendor-advisoryx_refsource_DEBIAN
https://access.redhat.com/security/cve/cve-2011-2935
vendor-advisoryx_refsource_REDHAT
https://oss-security.openwall.narkive.com/1UH3NYx8/cve-re...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.