Validate-before-filter vulnerability in cleanhtml.pl 1.129 in LiveJournal CVS before Dec...
Vulnerability Description
Validate-before-filter vulnerability in cleanhtml.pl 1.129 in LiveJournal CVS before Dec 7 2005, when the cleancss option is enabled, allows remote attackers to conduct cross-site scripting (XSS) attacks via a "\" (backslash) within a "javascript" scheme in a style property (such as "javas\cript"), which bypasses the "javascript" check before the "\" is stripped and then rendered in web browsers that allow scripting in style sheets.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2005-4454
Credits & Attribution
No credits recorded in the NVD database.
References
- http://secunia.com/advisories/18157
- http://www.osvdb.org/21896
- http://marc.info/?l=full-disclosure&m=113504421421972&w=2
- https://exchange.xforce.ibmcloud.com/vulnerabilities/23839
- http://cvs.livejournal.org/browse.cgi/livejournal/cgi-bin/cleanhtml.pl
- http://archives.neohapsis.com/archives/fulldisclosure/2005-12/1000.html
- http://www.securityfocus.com/bid/15990
Affected Vendor
livejournal
View all reports →Affected Software
Timeline
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.