CVE-2005-4305: XSS
First published: Sat Dec 17 2005(Updated: )
Cross-site scripting (XSS) vulnerability in Edgewall Trac 0.9, 0.9.1, and 0.9.2 allows remote attackers to inject arbitrary web script or HTML via the URL, which is not properly sanitized before it is returned in an error page.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Edgewall Trac | =0.9 | |
| Edgewall Trac | =0.9.1 | |
| Edgewall Trac | =0.9.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://secunia.com/advisories/18048
- http://securitytracker.com/id?1015363
- http://www.gentoo.org/security/en/glsa/glsa-200601-12.xml
- http://secunia.com/advisories/18625
- http://projects.edgewall.com/trac/wiki/ChangeLog
- http://www.securityfocus.com/bid/16386
- http://www.vupen.com/english/advisories/2005/2936
- https://exchange.xforce.ibmcloud.com/vulnerabilities/23775
Frequently Asked Questions
What is the severity of CVE-2005-4305?
CVE-2005-4305 is classified as a cross-site scripting (XSS) vulnerability, which can lead to significant security risks for users.
How do I fix CVE-2005-4305?
To fix CVE-2005-4305, it is recommended to upgrade to a patched version of Edgewall Trac that addresses the XSS vulnerability.
Which versions of Edgewall Trac are affected by CVE-2005-4305?
CVE-2005-4305 affects Edgewall Trac versions 0.9, 0.9.1, and 0.9.2.
What types of attacks can be executed due to CVE-2005-4305?
CVE-2005-4305 allows attackers to inject arbitrary web scripts or HTML, potentially leading to session hijacking or data theft.
Is user input validation an issue in CVE-2005-4305?
Yes, CVE-2005-4305 highlights a lack of proper input sanitization, making user inputs vulnerable to XSS attacks.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- vendor/edgewall software
- canonical/edgewall trac
- version/edgewall trac/0.9
- version/edgewall trac/0.9.1
- version/edgewall trac/0.9.2