Re: XSS in info2www

On Wed, Nov 17, 2004 at 01:07:10AM +0100, Nicolas Gregoire wrote:

> For your information, there's a XSS vulnerabilty in the info2www CGI
> (tested on unstable).
> 
> Exploit string :
> /cgi-bin/info2www?(coreutils)<script>alert(document.cookie)</script>

  Cookies or other authentification are not used on this CGI script so
 there are no immediately obvious security implications.

  I think this means that a security update would be unlikely,
 unless there is something I'm missing.

Steve
--