CVE-2011-1401

NameCVE-2011-1401
Descriptionikiwiki before 3.20110328 does not ascertain whether the htmlscrubber plugin is enabled during processing of the "meta stylesheet" directive, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences in (1) the default stylesheet or (2) an alternate stylesheet.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-2214-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
ikiwiki (PTS)bookworm, bullseye3.20200202.3-1fixed
sid, trixie3.20200202.4-2.1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
ikiwikisourcelenny2.53.6DSA-2214-1
ikiwikisourcesqueeze3.20100815.7DSA-2214-1
ikiwikisource(unstable)3.20110328

Search for package or bug name: Reporting problems