GHSA-6rm6-mjmh-86jq

HTML Purifier Cross-site Scripting (XSS) vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2010-2479

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	ezyang/htmlpurifier	< 4.1.1	4.1.1

Details

As written in the advisory (Markdown source, shown as plain text).

Cross-site scripting (XSS) vulnerability in HTML Purifier before 4.1.1, as used in Mahara and other products, when the browser is Internet Explorer, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2010-2479 advisory
https://github.com/FriendsOfPHP/security-advisories/blob/master/ezyang/htmlpurifier/CVE-2010-2479.yaml web
https://github.com/ezyang/htmlpurifier package
http://htmlpurifier.org/news/2010/0531-4.1.1-released web
http://repo.or.cz/w/htmlpurifier.git/commitdiff/18e538317a877a0509ae71a860429c41770da230 web
http://secunia.com/advisories/39613 web
http://secunia.com/advisories/40431 web
http://wiki.mahara.org/Release_Notes/1.0.15 web
http://wiki.mahara.org/Release_Notes/1.1.9 web
http://wiki.mahara.org/Release_Notes/1.2.5 web
http://www.securityfocus.com/bid/41259 web