Cross-site Scripting in Elgg Prior to 1.8.5
CVE-2012-6561

Currently unrated

Key Information:

Vendor: Elgg
Status: Elgg
Vendor: CVE Published:; 23 May 2013

What is CVE-2012-6561?

An XSS vulnerability exists in the Elgg platform in the engine/lib/views.php file, affecting versions before 1.8.5. This vulnerability allows attackers to inject arbitrary web scripts or HTML through the view parameter in index.php, potentially leading to the execution of malicious scripts in user browsers. This can compromise user data, session cookies, or any sensitive information stored in the browser.

References

http://blog.elgg.org/pg/blog/evan/read/209/elgg-185-released

x_refsource_CONFIRM

http://secunia.com/advisories/49129

third-party-advisoryx_refsource_SECUNIA

http://elgg.org/getelgg.php?forward=elgg-1.8.5.zip

x_refsource_CONFIRM

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
May 23, 2013
Vulnerability Reserved
May 23, 2013

CVE-2012-6561 Data

JSON