Geeklog 2.1.0: XSSDate: 2015-12-02 11:14:18
|Affected Product:||Geeklog 2.1.0|
|Fixed Version Link:||https://www.geeklog.net/filemgmt/visit.php/1156|
|Reported to vendor:||09/29/2015|
|Disclosed to public:||12/02/2015|
|Release mode:||Coordinated release|
|CVE:||requested, but not assigned|
|Credits||Tim Coen of Curesec GmbH|
2. Vulnerability Description
Medium 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N
There is at least one XSS vulnerability in the installation script of Geeklog.
Geeklog recommends to delete the install directory and displays warnings in the admin area if this is not the case. However, deleting the install directory is not mandatory, so it should be assumed that not all users will delete it.
3. Proof of Concept
To mitigate this issue please upgrade at least to version 2.1.1b3:
Please note that a newer version might already be available.
5. Report Timeline
|09/29/2015||Informed Vendor about Issue (no reply)|
|10/21/2015||Reminded Vendor of Disclosure Date|
|10/21/2015||Vendor asks for an additional two weeks for testing|
|11/17/2015||CVE Requested (no reply)|
|11/30/2015||Vendor releases fix|
|12/02/2015||Disclosed to public|