CVE-2004-0310: XSS

Published Mar 18, 2004

Updated

Cross-site scripting (XSS) vulnerability in LiveJournal 1.0 and 1.1 allows remote attackers to execute Javascript as other users via the stylesheet, which does not strip the semicolon or parentheses, as demonstrated using a background:url.

Affected Software

1 affected component

LiveJournal LiveJournal

Event History

Mar 18, 2004

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Frequently Asked Questions

What attacker access is required to exploit this issue?

The vulnerability can be exploited remotely and does not require authentication. An attacker must be able to supply a crafted stylesheet containing JavaScript through the affected stylesheet handling.

What is the impact if exploitation succeeds?

Successful exploitation allows JavaScript to run as other users. The provided vector indicates that stylesheet filtering fails to remove semicolons and parentheses, allowing a background:url-based payload.

Which versions are identified as affected?

The affected versions identified are LiveJournal 1.0 and 1.1.

CVE-2004-0310: XSS

Affected Software

Event History

Frequently Asked Questions

What attacker access is required to exploit this issue?

What is the impact if exploitation succeeds?

Which versions are identified as affected?

Company

Resources

Contact

Frequently Asked Questions

What attacker access is required to exploit this issue?

What is the impact if exploitation succeeds?

Which versions are identified as affected?