Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:27031
HistorySep 20, 2011 - 12:00 a.m.

Update: Vulnerability in plugins for Typepad, RapidWeaver, Habari, DasBlo, eZ Publish, EE, Serendipity, Social Web CMS, PHP-Fusion, Magento and Sweetcron

2011-09-2000:00:00
vulners.com
27

Hello 3APA3A!

One update concerning Cross-Site Scripting vulnerability in multiple plugins for different engines (in plugins for Typepad, RapidWeaver, Habari, DasBlo, eZ Publish, EE, Serendipity, Social Web CMS, PHP-Fusion, Magento and Sweetcron, which all are ports of WP-Cumulus). Which I wrote about earlier.

Besides, EZcumulus for eZ Publish, there is another vulnerable plugin eZ Flash Tag Cloud - it's another plugin for eZ Publish (with tagcloud.swf). Which is supported by developers, unlike EZcumulus.

Vulnerable version eZ Flash Tag Cloud 1.0. After my informing, the developers fixed XSS in version 1.1 (http://projects.ez.no/ezflashtagcloud/forum/general/flash_tag_cloud_v1_1_security_update), but it's still vulnerable to HTML Injection.

Concerning EZcumulus then, as representative of eZ Systems told me, because of that EZcumulus is not supported, then downloading of it was disabled at official site (and it'll not be updated to fix this issue). So it's recommended for all eZ Publish users, who are using EZcumulus, to change it to eZ Flash Tag Cloud 1.1.

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua