XSS in Ushahidi Platform

CVE-2012-3476

Multiple cross-site scripting (XSS) vulnerabilities in (1) application/views/admin/layout.php and (2) themes/default/views/header.php in the Ushahidi Platform before 2.5 allow remote authenticated users to inject arbitrary web script or HTML via vectors related to a site name.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.011 (62.0th percentile) — read the EPSS interpretation.

Affected products

Ushahidi Ushahidi_platform — versions 1.0, 1.2, 2.0
N/a — versions n/a

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

secalert@redhat.com (mailing-list, x_refsource_MLIST)
secalert@redhat.com (x_refsource_CONFIRM, Exploit, Patch)