Cross-site scripting (XSS) vulnerability in templatefunctions.py in Loggerhead before 1.18.1 allows remote authenticated users to inject arbitrary web script or HTML via a filename, which is not properly handled in a revision view.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Cross-site scripting (XSS) vulnerability in templatefunctions.py in Loggerhead before 1.18.1 allows remote
    authenticated users to inject arbitrary web script or HTML via a filename, which is not properly handled
    in a revision view. (CVE-2011-0728)

- New upstream release to fix CVE-2011-0728

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
434420	SCA: security update for loggerhead (GHSA-qjmg-77xh-7mjw)	Tenable Cloud Security	SCA Checks	Local	low
434420	SCA: security update for loggerhead (GHSA-qjmg-77xh-7mjw)	Tenable Self-Hosted Container Security	SCA Checks	Local	low
53264	Fedora 13 : loggerhead-1.18.1-1.fc13 (2011-4107)	Nessus	Fedora Local Security Checks	Local	low
53262	Fedora 14 : loggerhead-1.18.1-1.fc14 (2011-4085)	Nessus	Fedora Local Security Checks	Local	low
53261	Fedora 15 : loggerhead-1.18.1-1.fc15 (2011-4050)	Nessus	Fedora Local Security Checks	Local	low

Detections

Analytics

CVE-2011-0728

low

Tenable Plugins

low

low

low

low

low