CVE-2013-4433: XSS
Cross-site scripting (XSS) vulnerability in XHProf before 0.9.4 allows remote attackers to inject arbitrary web script or HTML via the run parameter.
Other sources
xhprof, a hierarchial profiler for PHP, was found to have a Cross-Site Scripting vulnerability in it's run parameter, because it fails to sufficiently sanitize the user input.
To exploit this vulnerability, an attacker must entice an unsuspecting user to follow a malicious URI, which could compromise the cookie-based authentication information, execute arbitrary client-side scripts in the context of the browser, or obtain sensitive information.
The issue is known to be fixed in Xhprof 0.9.4.
References:
http://www.securityfocus.com/bid/62928/info http://pecl.php.net/package-changelog.php?package=xhprof&release=0.9.4
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4433?
CVE-2013-4433 is classified as a high severity vulnerability due to its potential for impactful cross-site scripting attacks.
How do I fix CVE-2013-4433?
To fix CVE-2013-4433, upgrade to xhprof version 0.9.4 or later.
What types of software are affected by CVE-2013-4433?
CVE-2013-4433 affects xhprof versions prior to 0.9.4, including 0.9.0, 0.9.1, 0.9.2, and 0.9.3.
What is the nature of the vulnerability in CVE-2013-4433?
CVE-2013-4433 is a cross-site scripting (XSS) vulnerability that allows attackers to inject arbitrary web scripts or HTML.
Is CVE-2013-4433 exploitable remotely?
Yes, CVE-2013-4433 can be exploited remotely by attackers through the vulnerable run parameter.