[Secure-testing-team] Bug#748828: collabtive: CVE-2014-3246 CVE-2014-3247

[Salvatore Bonaccorso]

Source: collabtive
Severity: grave
Tags: security upstream

Hi,

the following vulnerabilities were published for collabtive.

CVE-2014-3246[0]:
| SQL injection vulnerability in Collabtive 1.2 allows remote
| authenticated users to execute arbitrary SQL commands via the folder
| parameter in a fileview_list action to manageajax.php.

CVE-2014-3247[1]:
| Cross-site scripting (XSS) vulnerability in Collabtive 1.2 allows
| remote authenticated users to inject arbitrary web script or HTML via
| the desc parameter in an Add project (addpro) action to admin.php.

If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3246
    https://security-tracker.debian.org/tracker/CVE-2014-3246
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3247
    https://security-tracker.debian.org/tracker/CVE-2014-3247

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore