CVE-2012-1575: XSS
A number of XSS flaws were reported in Cumin. These flaws could be used by a remote attacker to inject arbitrary web script on a web page displayed by Cumin.
To solve the problem, xmlescape() (as defined in wooly/python/wooly/util.py, a simple wrapper around xml.sax.saxutils.escape()) is called on any values that are displayed on a web page and originate outside of Cumin, or through a form submitted by a user. Many of these have been corrected upstream in r5238 [1].
[1] https://fedorahosted.org/pipermail/cumin-developers/2012-March/000796.html
Other sources
Multiple cross-site scripting (XSS) vulnerabilities in Cumin before r5238 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) widgets or (2) pages.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-1575?
CVE-2012-1575 is classified as a medium-severity vulnerability due to its potential for Cross-Site Scripting (XSS) attacks.
How do I fix CVE-2012-1575?
To fix CVE-2012-1575, ensure that the xml_escape() function is implemented properly in the Cumin application to mitigate XSS risks.
What type of vulnerability is CVE-2012-1575?
CVE-2012-1575 is an XSS (Cross-Site Scripting) vulnerability that allows remote attackers to inject arbitrary web scripts.
Which software versions are affected by CVE-2012-1575?
CVE-2012-1575 affects Cumin versions up to and including r5237.
Can CVE-2012-1575 be exploited remotely?
Yes, CVE-2012-1575 can be exploited remotely by attackers to execute scripts in the context of affected users.