Bug 63063

Summary:	www-apps/phpgroupware: XSS Vulnerability
Product:	Gentoo Security	Reporter:	Luke Macken (RETIRED) <lewk>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	normal	CC:	web-apps, x86
Priority:	High
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	http://secunia.com/advisories/12466/
Whiteboard:	B3 [stable] lewk
Package list:		Runtime testing required:	---

Description Luke Macken (RETIRED) gentoo-dev

2004-09-06 15:35:05 UTC

TITLE:
phpGroupWare Unspecified Cross-Site Scripting Vulnerability

SECUNIA ADVISORY ID:
SA12466

VERIFY ADVISORY:
http://secunia.com/advisories/12466/

CRITICAL:
Less critical

IMPACT:
Cross Site Scripting

WHERE:
>From remote

SOFTWARE:
phpGroupWare 0.x
http://secunia.com/product/1814/

DESCRIPTION:
An unspecified vulnerability has been reported in phpGroupWare, which
can be exploited by malicious people to conduct cross-site scripting
attacks.

No more information is currently available.

SOLUTION:
Update to version 0.9.16.003.
http://downloads.phpgroupware.org/now

PROVIDED AND/OR DISCOVERED BY:
Reported by vendor.

ORIGINAL ADVISORY:
http://downloads.phpgroupware.org/changelog

Reproducible: Always
Steps to Reproduce:
1.
2.
3.

Comment 1 Luke Macken (RETIRED) gentoo-dev

2004-09-06 15:39:04 UTC

web-apps,

can you please bump to 0.9.16.003

Comment 2 Sune Kloppenborg Jeppesen (RETIRED) gentoo-dev

2004-09-06 23:55:02 UTC

A few more details from www.phpgroupware.org:

A XSS exploit has been discovered in the wiki module. The release fixes the problem and a few other bugs.

Comment 3 Martin Holzer (RETIRED) gentoo-dev

2004-09-07 01:11:35 UTC

also makes php5 users happy :)

Comment 4 Renat Lumpau (RETIRED) gentoo-dev

2004-09-08 01:14:01 UTC

In CVS

Comment 5 Thierry Carrez (RETIRED) gentoo-dev

2004-09-08 02:36:06 UTC

Arches, please test and mark www-apps/phpgroupware-0.9.16.003 stable

Comment 6 Pieter Van den Abeele (RETIRED) gentoo-dev

2004-09-08 14:31:05 UTC

ppc stable

Comment 7 Danny van Dyk (RETIRED) gentoo-dev

2004-09-15 05:52:01 UTC

stable on amd64.

Comment 8 Luke Macken (RETIRED) gentoo-dev

2004-09-15 10:35:45 UTC

x86, please mark stable.

Comment 9 Olivier Crete (RETIRED) gentoo-dev

2004-09-16 14:48:45 UTC

finally marking stable on x86... its all yours lewk ;)

Comment 10 Luke Macken (RETIRED) gentoo-dev

2004-09-16 15:06:01 UTC

GLSA 200409-22

Comment 11 Luke Macken (RETIRED) gentoo-dev

2004-10-28 18:38:32 UTC

x86, please mark stable to benefit from GLSA.