CVE-2013-1885: XSS
It was reported that Certificate System suffers from XSS flaws in the /tus/ and /tus/tus/ URLs, such as:
GET /tus/tus/%22%2b%61%6c%65%72%74%28%34%38%32%36%37%29%2b%22
or
GET /tus/%22%2b%61%6c%65%72%74%28%36%31%34%35%32%29%2b%22
which will in turn output something like:
<!-- var uriBase = "/tus/"+alert(85384)+"; var userid = "admin";
This was reported against Certificate System 8.1 and may also affect Dogtag 9 and 10.
Other sources
Multiple cross-site scripting (XSS) vulnerabilities in the token processing system (pki-tps) in Red Hat Certificate System (RHCS) 8.1 and possibly Dogtag Certificate System 9 and 10 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO to (1) tus/ or (2) tus/tus/.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-1885?
CVE-2013-1885 has a high severity rating because it exposes users to potential cross-site scripting attacks.
How do I fix CVE-2013-1885?
You can mitigate CVE-2013-1885 by upgrading to the patched version of the software, specifically version 8.1.5-1.el5 or newer.
What software is affected by CVE-2013-1885?
CVE-2013-1885 affects Red Hat Certificate System versions prior to 8.1.5-1.el5 and Dogtag Certificate System versions prior to 10.0.
What kind of attack does CVE-2013-1885 allow?
CVE-2013-1885 allows attackers to execute arbitrary JavaScript in the context of the affected application through XSS.
Is CVE-2013-1885 a common vulnerability in web applications?
Yes, XSS vulnerabilities like CVE-2013-1885 are common in web applications due to insufficient input validation.