Executive brief
QooxDoo is a popular JavaScript framework used to build web applications. A cross-site scripting (XSS) vulnerability in the callback parameter allows remote attackers to inject malicious scripts into web pages viewed by other users, potentially compromising user sessions, stealing credentials, or defacing application interfaces.
Technical details
This is a reflected cross-site scripting (XSS) vulnerability (CWE-79) in the jsonp_primitive.php resource handler within the QooxDoo framework. The vulnerability exists because user-supplied input from the callback parameter is not properly sanitized before being reflected in the HTTP response. An attacker can craft a malicious URL containing JavaScript code in the callback parameter; when a victim visits the URL, the script executes in their browser with the victim's session privileges. The attack requires user interaction (clicking a link) but no authentication. QooxDoo versions up to and including 1.3 are affected; the vulnerability was publicly disclosed in 2011.
Affected products
- QooxDoo QooxDoo 1.3 and earlier
Timeline
- 2011-04-18: disclosed: CVE-2011-1714 published
- 2022-05-17: advisory: GHSA-pchf-755w-jj6v published