Cross-Site Scripting (XSS) Vulnerability in Trac - CVE-2007-1405
Summary
CVE-2007-1405: Cross-site scripting (XSS) vulnerability in the "download wiki page as text" feature in Trac before 0.10.3.1, when Microsoft Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via u... Affects trac versions < 0.10.4-1. Fixed in 0.10.4-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Trac is an open-source project management and issue tracking system that provides a wiki and an interface for managing software development projects. It is widely used for its simplicity and integration capabilities. However, prior to version 0.10.3.1, Trac had a vulnerability in its 'download wiki page as text' feature, particularly when accessed through Microsoft Internet Explorer, which allowed for potential XSS attacks.
Vulnerability Detail
The vulnerability identified as CVE-2007-1405 is a cross-site scripting (XSS) flaw that affects Trac versions before 0.10.3.1. This issue arises when the 'download wiki page as text' feature is used, allowing remote attackers to inject arbitrary web scripts or HTML through unspecified parameters. The exploitation of this vulnerability can lead to unauthorized actions being performed on behalf of users, data theft, or the spread of malware.
How To Fix
Minimum fixed version
0.10.4-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade tracTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the 'download wiki page as text' feature or advise users to avoid using Microsoft Internet Explorer when accessing Trac until the upgrade is completed.
Conclusion
CVE-2007-1405 represents a significant security risk for users of Trac prior to version 0.10.3.1. It is crucial to upgrade to the latest version to protect against potential XSS attacks. Users should also consider using tools like Vulert to monitor for vulnerabilities in their software.
See every vulnerability recorded for trac →
FAQ
CVE-2007-1405 is a cross-site scripting vulnerability in Trac that allows attackers to inject malicious scripts via the 'download wiki page as text' feature.
Trac versions prior to 0.10.3.1 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The risks include unauthorized actions on behalf of users, data theft, and the potential spread of malware.
Yes, you can restrict access to the vulnerable feature or advise users to avoid using Internet Explorer until the upgrade is completed.
Related vulnerabilities
Recent vulnerabilities recorded for trac.
