phpGroupWare: XSS vulnerability in wiki module

1. Gentoo Linux Security Advisory

Package	Vulnerable versions	Unaffected versions	Architecture(s)
www-apps/phpgroupware	< 0.9.16.003	>= 0.9.16.003	All supported architectures

Related bugreports: #63063

The phpGroupWare software contains a cross site scripting vulnerability in the wiki module.

2. Impact Information

phpGroupWare is a web-based suite of group applications including calendar, todo-list, addressbook, email, wiki, news headlines, and a file manager.

Due to an input validation error, the wiki module in the phpGroupWare suite is vulnerable to cross site scripting attacks.

This vulnerability gives an attacker the ability to inject and execute malicious script code, potentially compromising the victim's browser.

3. Resolution Information

The is no known workaround at this time.

All phpGroupWare users should upgrade to the latest version:

Code Listing 3.1: Resolution

# emerge sync

# emerge -pv ">=www-apps/phpgroupware-0.9.16.003"
# emerge ">=www-apps/phpgroupware-0.9.16.003"

4. References

Updated September 16, 2004

Summary: This is a Gentoo Linux Security Advisory

Security Team
Contact Address

Donate to support our development efforts.