CVE-2015-2793

NameCVE-2015-2793
DescriptionCross-site scripting (XSS) vulnerability in templates/openid-selector.tmpl in ikiwiki before 3.20150329 allows remote attackers to inject arbitrary web script or HTML via the openid_identifier parameter in a verify action to ikiwiki.cgi.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium
Debian Bugs781483

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
ikiwiki (PTS)stretch (security), stretch3.20170111.1fixed
buster3.20190228-1fixed
bookworm, sid, bullseye3.20200202.3-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
ikiwikisourcewheezy3.20120629.2
ikiwikisource(unstable)3.20141016.2781483

Notes

[squeeze] - ikiwiki <no-dsa> (Minor issue)
https://www.openwall.com/lists/oss-security/2015/03/30/5

Search for package or bug name: Reporting problems