← back
CVE-2005-4454

CVE-2005-4454

EPSS 2.1%
Validate-before-filter vulnerability in cleanhtml.pl 1.129 in LiveJournal CVS before Dec 7 2005, when the cleancss option is enabled, allows remote attackers to conduct cross-site scripting (XSS) attacks via a "\" (backslash) within a "javascript" scheme in a style property (such as "javas\cript"), which bypasses the "javascript" check before the "\" is stripped and then rendered in web browsers that allow scripting in style sheets.
Affected products
n/a · n/a
public PoCs found — 1
exploitdbwww.exploit-db.com/exploits/26917unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://archives.neohapsis.com/archives/fulldisclosure/2005-12/1000.htmlhttp://cvs.livejournal.org/browse.cgi/livejournal/cgi-bin/cleanhtml.plhttp://marc.info/?l=full-disclosure&m=113504421421972&w=2http://secunia.com/advisories/18157https://exchange.xforce.ibmcloud.com/vulnerabilities/23839http://www.osvdb.org/21896http://www.securityfocus.com/bid/15990