bonsai: multiple vulnerabilites [LWN.net]

Package(s):

bonsai

CVE #(s):

CAN-2003-0152 CAN-2003-0153 CAN-2003-0154 CAN-2003-0155

Created:

March 21, 2003

Updated:

March 26, 2003

Description:

Remi Perrot fixed several security related bugs in bonsai, the Mozilla CVS query tool by web interface. Vulnerabilities include arbitrary code execution, cross-site scripting and access to configuration parameters.

The Common Vulnerabilities and Exposures project identifies the following problems:

CAN-2003-0152 - Remote execution of arbitrary commands as www-data
CAN-2003-0153 - Absolute path disclosure
CAN-2003-0154 - Cross site scriptiong attacks
CAN-2003-0155 - Unauthenticated access to parameters page

Alerts:

Debian

DSA-265-1

2003-03-21

(Log in to post comments)