Bug 974654 - conga (Plone): HTTP injection via benevolent cookie setting method triggered by malicious URL (accessed by authorized user)
Summary: conga (Plone): HTTP injection via benevolent cookie setting method triggered ...
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 956861
Blocks: 971604
TreeView+ depends on / blocked
 
Reported: 2013-06-14 17:55 UTC by Jan Pokorný [poki]
Modified: 2021-02-17 07:36 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of: CVE-2013-6496
Environment:
Last Closed: 2015-01-20 17:27:41 UTC
Embargoed:

Attachments (Terms of Use)

Comment 3 Jan Lieskovsky 2013-06-21 09:36:42 UTC 
A HTTP injection flaw was found in the way Plone, a user friendly and powerful content management system, performed sanitization of HTTP cookie values provided within certain URL requests. A remote attacker could provide a specially-crafted URL that, then visited by an authenticated Plone user would lead to arbitrary HTML or web script execution in the context of the Plone user's session.

A different vulnerability than CVE-2012-5486.

Acknowledgements:

This issue was discovered by Jan Pokorny of Red Hat.
Comment 4 Jan Lieskovsky 2013-06-21 09:38:53 UTC 
This issue affects the version of the conga package, as shipped with Red Hat Enterprise Linux 5.
Comment 5 Vincent Danen 2015-01-20 17:27:41 UTC 
Statement:

Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.
Note You need to log in before you can comment on or make changes to this bug.