FreeBSD : flyspray -- multiple vulnerabilities (9d3020e4-a2c4-11dd-a9f9-0030843d3802)
Medium Nessus Plugin ID 34498
SynopsisThe remote FreeBSD host is missing a security-related update.
DescriptionThe Flyspray Project reports :
Flyspray is affected by a Cross Site scripting Vulnerability due missing escaping of SQL error messages. By including HTML code in a query and at the same time causing it to fail by submitting invalid data, an XSS hole can be exploited.
There is an XSS problem in the task history attached to comments, since the application fails to sanitize the old_value and new_value database fields for changed task summaries.
Input passed via the 'item_summary' parameter to 'index.php?do=details' is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
SolutionUpdate the affected package.