|
[Japanese]
|
JVNDB-2007-000454
|
dotProject cross-site scripting vulnerability
|
|
dotProject, an open source project management tool, contains a cross-site scripting vulnerability.
This vulnerability is different from JVN#97636431.
|
|
Base Metrics:
4.3 (Medium)
[IPA Score]
- Access Vector: Network
- Access Complexity: Medium
- Authentication: None
- Confidentiality Impact: None
- Integrity Impact: Partial
- Availability Impact: None
|
|
|
|
dotProject
- dotProject 2.0.4 and earlier
|
|
|
An arbitrary script may be executed on the user's web browser. In particular, if session information from a cookie is leaked, session hijacking could be conducted.
|
|
[Update the Software]
The developer has released dotProject version 2.1 RC2 that addresses this vulnerability. We recommend that users upgrade to the version.
|
|
dotProject
|
|
|
|
- CVE-2007-3226
|
|
- JVN : JVN#63602912
- National Vulnerability Database (NVD) : CVE-2007-3226
- Secunia Advisory : SA25638
|
|
[2008/05/21]
Web page published
|
