Test ID:	1.3.6.1.4.1.25623.1.0.112058
Category:	Web application abuses
Title:	Kallithea < 0.2.1 Multiple XSS Vulnerabilities
Summary:	Kallithea is prone to multiple cross-site scripting (XSS) vulnerabilities.
Description:	Summary: Kallithea is prone to multiple cross-site scripting (XSS) vulnerabilities. Vulnerability Insight: HTML and Javascript injection was possible in several places in the Kallithea UI, allowing attackers to run malicious code. User details (first name, last name) as well as repository, repository group and user group descriptions were pasted unfiltered into the HTML code, thus attacker could inject malicious code. Vulnerability Impact: As the vulnerability allows attacker to execute arbitrary code in the user's browser, it can be used to gain access to the user's account by stealing credentials, like API keys. It is also possible for the attacker to gain full administrator access to the Kallithea instance. Affected Software/OS: Kallithea before version 0.2.1 Solution: Upgrade to Kallithea version 0.2.1 or later. CVSS Score: 3.5 CVSS Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N
Cross-Ref:	BugTraq ID: 74184 Common Vulnerability Exposure (CVE) ID: CVE-2015-1864 http://www.securityfocus.com/bid/74184 http://www.openwall.com/lists/oss-security/2015/04/14/12
Copyright	Copyright (C) 2017 Greenbone Networks GmbH

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.