CVE-2015-7391: XSS
Multiple cross-site scripting (XSS) vulnerabilities in TestLink before 1.9.14 allow remote attackers to inject arbitrary web script or HTML via the (1) selectedenddate or (2) selectedstartdate parameter to lib/results/tcCreatedPerUserOnTestProject.php; the (3) containerType parameter to lib/testcases/containerEdit.php; the (4) filtertcid or (5) filtertestcasename parameter to lib/testcases/listTestCases.php; the (6) useRecursion parameter to lib/testcases/tcImport.php; the (7) targetTestCase or (8) createdby parameter to lib/testcases/tcSearch.php; or the (9) HTTP Referer header to thirdparty/usercontribution/fakeRemoteExecServer/client4fakeXMLRPCTestRunner.php.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-7391?
CVE-2015-7391 is classified as a high severity vulnerability due to its potential for remote code execution through cross-site scripting.
How do I fix CVE-2015-7391?
To fix CVE-2015-7391, upgrade TestLink to version 1.9.14 or later, which addresses these XSS vulnerabilities.
What components of TestLink are affected by CVE-2015-7391?
CVE-2015-7391 affects multiple components of TestLink, specifically parameters related to dates in the results and test project functionalities.
Can CVE-2015-7391 be exploited remotely?
Yes, CVE-2015-7391 can be exploited remotely by attackers to inject arbitrary scripts into web pages.
What types of attacks can originate from CVE-2015-7391?
CVE-2015-7391 can lead to Cross-Site Scripting attacks, allowing attackers to execute arbitrary scripts in users' browsers.