CVE-2016-10245 Cross-site scripting in n/a
Attackers can inject malicious scripts via the search query parameter, potentially stealing user data or hijacking sessions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2016-10245?
CVE-2016-10245 is a medium-severity cross-site scripting vulnerability in n/a, published on 24 May 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Insufficient sanitization of the query parameter in templates/html/search_opensearch.php could lead to reflected cross-site scripting or iframe injection.
Weakness: CWE-79
Which versions are affected by CVE-2016-10245?
It affects 1 product.
Linux distribution packages (22)
doxygen Red Hat:enterprise_linux:7::client | All versions | 1:1.8.5-4.el7 |
doxygen-debuginfo Red Hat:enterprise_linux:7::client | All versions | 1:1.8.5-4.el7 |
doxygen-doxywizard Red Hat:enterprise_linux:7::client | All versions | 1:1.8.5-4.el7 |
doxygen-latex Red Hat:enterprise_linux:7::client | All versions | 1:1.8.5-4.el7 |
doxygen Red Hat:enterprise_linux:7::computenode | All versions | 1:1.8.5-4.el7 |
doxygen-debuginfo Red Hat:enterprise_linux:7::computenode | All versions | 1:1.8.5-4.el7 |
doxygen-doxywizard Red Hat:enterprise_linux:7::computenode | All versions | 1:1.8.5-4.el7 |
doxygen-latex Red Hat:enterprise_linux:7::computenode | All versions | 1:1.8.5-4.el7 |
doxygen Red Hat:enterprise_linux:7::server | All versions | 1:1.8.5-4.el7 |
doxygen-debuginfo Red Hat:enterprise_linux:7::server | All versions | 1:1.8.5-4.el7 |
doxygen-doxywizard Red Hat:enterprise_linux:7::server | All versions | 1:1.8.5-4.el7 |
doxygen-latex Red Hat:enterprise_linux:7::server | All versions | 1:1.8.5-4.el7 |
doxygen Red Hat:enterprise_linux:7::workstation | All versions | 1:1.8.5-4.el7 |
doxygen-debuginfo Red Hat:enterprise_linux:7::workstation | All versions | 1:1.8.5-4.el7 |
doxygen-doxywizard Red Hat:enterprise_linux:7::workstation | All versions | 1:1.8.5-4.el7 |
doxygen-latex Red Hat:enterprise_linux:7::workstation | All versions | 1:1.8.5-4.el7 |
doxygen SUSE:Linux Enterprise Desktop 12 SP3 | All versions | 1.8.6-3.3.1 |
doxygen SUSE:Linux Enterprise Desktop 12 SP4 | All versions | 1.8.6-3.3.1 |
doxygen SUSE:Linux Enterprise Software Development Kit 12 SP3 | All versions | 1.8.6-3.3.1 |
doxygen SUSE:Linux Enterprise Software Development Kit 12 SP4 | All versions | 1.8.6-3.3.1 |
doxygen SUSE:Linux Enterprise Workstation Extension 12 SP3 | All versions | 1.8.6-3.3.1 |
doxygen SUSE:Linux Enterprise Workstation Extension 12 SP4 | All versions | 1.8.6-3.3.1 |
Products include Doxygen Doxygen.
How do I fix CVE-2016-10245?
Apply the vendor's patch.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2016-10245 being exploited?
There is no known exploitation of CVE-2016-10245 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2016-10245, DLA-1812-1, GHSA-wr8j-hpcv-cgmx, RHSA-2020:1034, SUSE-SU-2019:1570-1, UBUNTU-CVE-2016-10245 and 1 more.