Bug 830243 (CVE-2012-2683)

Summary: CVE-2012-2683 cumin: multiple XSS flaws
Product: [Other] Security Response Reporter: Vincent Danen <vdanen>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: fweimer, grid-maint-list, security-response-team, sgraf, tmckay
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 840133 (view as bug list) Environment:
Last Closed: 2021-10-19 21:53:43 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 807970, 831235, 831244, 840133, 858868    
Bug Blocks: 808230, 828434, 828935    
Attachments:
Description Flags
Call xml_escape() on error page content none

Description Vincent Danen 2012-06-08 15:49:25 UTC 
Multiple XSS flaws were reported in Cumin.  These flaws could be used by a remote attacker to inject arbitrary web script on a web page displayed by Cumin.  This includes an XSS in error message displays due to not filtering the displayed output, and not escaping quotes in source HTML on certain pages.
Comment 2 Trevor McKay 2012-06-08 17:14:14 UTC 
Created attachment 590472 [details]
Call xml_escape() on error page content
Comment 5 Vincent Danen 2012-09-19 16:10:01 UTC 
Acknowledgements:

These issues were discovered by Florian Weimer of the Red Hat Product Security Team.
Comment 6 errata-xmlrpc 2012-09-19 17:43:43 UTC 
This issue has been addressed in following products:

  MRG for RHEL-5 v. 2

Via RHSA-2012:1278 https://rhn.redhat.com/errata/RHSA-2012-1278.html
Comment 7 errata-xmlrpc 2012-09-19 17:52:51 UTC 
This issue has been addressed in following products:

  MRG for RHEL-6 v.2

Via RHSA-2012:1281 https://rhn.redhat.com/errata/RHSA-2012-1281.html
Comment 8 Vincent Danen 2012-09-19 21:09:59 UTC 
Created cumin tracking bugs for this issue

Affects: fedora-all [bug 858868]
Comment 9 Fedora Update System 2012-11-20 03:02:03 UTC 
cumin-0.1.5522-4.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 10 Fedora Update System 2012-11-20 03:15:31 UTC 
cumin-0.1.5522-4.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 11 Fedora Update System 2013-03-14 02:55:04 UTC 
cumin-0.1.5522-4.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.