CVE-2016-1229: XSS

Published Jun 5, 2016

Updated

Cross-site scripting (XSS) vulnerability in HumHub 0.20.0-beta.1 through 0.20.1 and 1.0.0-beta before 1.0.0-beta.3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

Affected Software

6 affected components

Humhub Humhub=0.20.0

Humhub Humhub=0.20.0-beta1

Humhub Humhub=0.20.0-beta2

Humhub Humhub=0.20.1

Humhub Humhub=1.0.0-beta1

Humhub Humhub=1.0.0-beta2

Remediation

Patch Available

https://github.com/humhub/humhub/releases/tag/v1.0.0-beta.3

Event History

Jun 5, 2016

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2016-1229?

CVE-2016-1229 is classified as a medium severity vulnerability due to its ability to allow cross-site scripting attacks.

How do I fix CVE-2016-1229?

To mitigate CVE-2016-1229, update the HumHub platform to version 1.0.0-beta.3 or later.

Who is affected by CVE-2016-1229?

CVE-2016-1229 affects users of HumHub versions 0.20.0-beta.1 through 0.20.1 and 1.0.0-beta before 1.0.0-beta.3.

What types of attacks can CVE-2016-1229 facilitate?

CVE-2016-1229 can facilitate cross-site scripting (XSS) attacks allowing the injection of arbitrary web scripts or HTML.

Are there any workarounds for CVE-2016-1229?

There are no documented workarounds for CVE-2016-1229; upgrading to a secure version is necessary for protection.