Detections
Analytics

Debian DSA-1094-1 : gforge - missing input sanitising

medium Nessus Plugin ID 22636

Synopsis

The remote Debian host is missing a security-related update.

Description

Joxean Koret discovered several cross-site scripting vulnerabilities in Gforge, an online collaboration suite for software development, which allow injection of web script code.

Solution

Upgrade the gforge package.

The old stable distribution (woody) does not contain gforge packages.

For the stable distribution (sarge) this problem has been fixed in version 3.1-31sarge1.

See Also

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=328224

http://www.debian.org/security/2006/dsa-1094

Plugin Details

Severity: Medium

ID: 22636

File Name: debian_DSA-1094.nasl

Version: 1.17

Type: local

Agent: unix

Published: 10/14/2006

Updated: 1/4/2021

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.8

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:gforge, cpe:/o:debian:debian_linux:3.1

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Patch Publication Date: 6/8/2006

Vulnerability Publication Date: 7/28/2005

Reference Information

CVE: CVE-2005-2430

DSA: 1094