CVE-2011-1157

Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) 5.x before 5.0.1 allows remote attackers to inject arbitrary web script or HTML via malformed XML comments.

Published Bysecalert@redhat.com

Published DateApr 11, 2011, 18:55

Affected Versions(1)

feedparser(PyPI)

Introduced5.0

Fixed5.0.1

LimitN/A

Package (Ecosystem)	Introduced	Fixed	Limit
feedparser(PyPI)	5.0	5.0.1	N/A

Weakness Type (CWE):CWE-79

CVSS Metrics

Base Score

4.3

Vector String

AV:N/AC:M/Au:N/C:N/I:P/A:N

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

NONE

Integrity (I)

PARTIAL

Availability (A)

NONE

References

http://lists.opensuse.org/opensuse-updates/2011-04/msg00026.html
http://openwall.com/lists/oss-security/2011/03/14/18
http://openwall.com/lists/oss-security/2011/03/15/11
http://secunia.com/advisories/43730
http://secunia.com/advisories/44074
http://support.novell.com/security/cve/CVE-2011-1157.html
http://www.mandriva.com/security/advisories?name=MDVSA-2011:082
http://www.securityfocus.com/bid/46867
https://bugzilla.novell.com/show_bug.cgi?id=680074
https://bugzilla.redhat.com/show_bug.cgi?id=684877
https://code.google.com/p/feedparser/issues/detail?id=254

Weakness Type (CWE):CWE-79

CVSS Metrics

Base Score

4.3

Vector String

AV:N/AC:M/Au:N/C:N/I:P/A:N

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

NONE

Integrity (I)

PARTIAL

Availability (A)

NONE