Release Date: 2004-02-23
Critical: Less critical
Impact: Cross Site Scripting
Where: From remote
Software: LiveJournal 1.x
Description:
Joshua Miller has reported a vulnerability in LiveJournal allowing malicious people to conduct Cross Site Scripting attacks.
The problem is that LiveJournal fails to filter parentheses and semicolons from URLs to background images and from stylesheets. This can be exploited by attackers who have created their own journal on a vulnerable system to inject arbitrary script code.
Solution:
Allow only trusted people to create their own journal.
Provided and/or discovered by:
Joshua Miller
Source: Secunia