Bug 974654 - conga (Plone): HTTP injection via benevolent cookie setting method triggered by malicious URL (accessed by authorized user)
conga (Plone): HTTP injection via benevolent cookie setting method triggered ...
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
Unspecified Unspecified
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
: Security
Depends On: 956861
Blocks: 971604
  Show dependency treegraph
Reported: 2013-06-14 13:55 EDT by Jan Pokorný
Modified: 2015-07-24 04:13 EDT (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: CVE-2013-6496
Last Closed: 2015-01-20 12:27:41 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Comment 3 Jan Lieskovsky 2013-06-21 05:36:42 EDT
A HTTP injection flaw was found in the way Plone, a user friendly and powerful content management system, performed sanitization of HTTP cookie values provided within certain URL requests. A remote attacker could provide a specially-crafted URL that, then visited by an authenticated Plone user would lead to arbitrary HTML or web script execution in the context of the Plone user's session.

A different vulnerability than CVE-2012-5486.


This issue was discovered by Jan Pokorny of Red Hat.
Comment 4 Jan Lieskovsky 2013-06-21 05:38:53 EDT
This issue affects the version of the conga package, as shipped with Red Hat Enterprise Linux 5.
Comment 5 Vincent Danen 2015-01-20 12:27:41 EST

Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

Note You need to log in before you can comment on or make changes to this bug.