Vulnerability Report Status

cross reference to vulnerability reports of 3rd party companies and organizations

Created by: Lester Caine, Last modification: 17 May 2009 (01:51 UTC) by spiderr
This page lists vulnerability reports – concerning the security of the Bitweaver application – posted on websites other than, in order to address and to discuss outstanding issues, and to identify their current status.

During and after the installation of Bitweaver, a user chooses to activate a sub-set of all available packages, modules, features, input formats, etc. A report on a security issues might be based on an unattended install, before the security recommendations were considered. A site with different settings may not be affected. As an example, a site configured to restrict input of data to wiki syntax will not be affected by HTML vulnerabilities.

Identifying and discussing these reports is necessary, because they might have one or all of the following problems:
  • the report is a clone of another report
  • insufficient information is given to verify the report
  • it is impossible to get the report updated to reflect the current status

List of reports

Date Site Resource Status Notes
2006CVECVE-2006-3103only Bitweaver version 1.3 s affected - superseded by version 2
2007CVECVE-2007-6374Multiple XSS Vulnerabilities
2007CVECVE-2007-6375SQL Injection Vulnerabilities
2007CVECVE-2007-6412Code Injection into content
2007-12-07HSC-ResearchWas 28129Fixed R2.1Bitweaver Cross-Site Scripting
2007-12-09XForce39129Duplicatesee HSC 7th Dec 2007
2007-12-09XForce39130Duplicatesee HSC 7th Dec 2007
2007-12-09XForce38943Fixed R2.1
2007-12-10Secunia28024DuplicateQuoted original advisory no longer available - see HSC 7th Dec 2007
2007-12-10securityfocus26801Duplicatesee HSC 7th Dec 2007
2007-12-09osvdb26801Duplicatesee HSC 7th Dec 2007
2007-12-11securityreason3428Duplicatesee HSC 7th Dec 2007
2007-12-11Vupen2007/4168Duplicatesee HSC 7th Dec 2007
2007-12-30AmnPardaz4814Not sure file upload problem is valid?
2007-09-25Secunia32014Fixed R2.1Multiple XSS Vulnerabilities
2007-09-25XForce45409Fixed R2.1
2007-09-28securityfocus31395Nothing identified to test
2008CVECVE-2008-4337Fixed R2.1Multiple XSS Vulnerabilities
2009-05-12Nine:Situations:Groupbitweaver_260Partial fixes 2.6.1
2009-05-12Milworm8659Partial fixes 2.6.1
2009-05-12VUPEN2009/1285Fixed 2.6.1
2009-05-12Secunia35057Partial fixes 2.6.1
2009-05-13engineeringforfunbitweaverPartial fixes 2.6.1Duplicated from

Report: Multiple XSS

The report named Multiple Cross-site Scripting Vulnerabilities has been duplicated across several sites, some of which do not list the concerned pages. The Secunia report has a list of pages that can be tested. In current versions of Bitweaver, these security issues have been fixed. They are all now handled correctly. For the original report, see Secunia Advisory: SA32014

To test if an install is compromised by the exploit, the string

can be used. Bitweaver version 2 and above prevent the creation of persistent XSS attacks, so the above script can not be stored within this page and will need to be added manually to the address bar of your browser. The string will be returned with the tag characters converted to %xx equivalents. Below is a list of PHP files of Bitweaver version 1.3 and below that are expected to be vulnerable to XSS-attacks. As the problem has been addressed within the core processing of Bitweaver, from version 2 on, these files and any other files, even if not listed here, are now considered to be immune against this exploit.

Further search results

CVE Listing 18 entries back to 2005, mainly XSS
Secunia Listing 7 entries sub set of CVE
XForce (IBM ISS) Listing 19 entries - not spotted the extra one over CVE