| <html> |
| <head> |
| <meta name="viewport" content="width=device-width, initial-scale=1"> |
| <title>mod_pagespeed Security Advisory: Cross-Site Scripting</title> |
| <link rel="stylesheet" href="doc.css"> |
| </head> |
| <body> |
| <!--#include virtual="_header.html" --> |
| |
| |
| <div id=content> |
| <h1>mod_pagespeed Security Advisory: Cross-Site Scripting</h1> |
| <dl> |
| <dt>CVE Identifier:</dt> |
| <dd>CVE-2012-4360</dd> |
| <dt>Disclosed:</dt> |
| <dd>September 12, 2012</dd> |
| <dt>Versions Affected:</dt> |
| <dd>mod_pagespeed versions 0.10.19.1 through 0.10.22.4 (inclusive). |
| Versions 0.9.18.6 and earlier are unaffected.</dd> |
| <dt>Summary:</dt> |
| <dd>mod_pagespeed performs insufficient escaping in some cases, which can |
| permit a hostile 3rd party to inject JavaScript running in context of |
| the site.</dd> |
| <dt>Solution:</dt> |
| <dd>mod_pagespeed 0.10.22.6 has been released with a fix.</dd> |
| </div> |
| <!--#include virtual="_footer.html" --> |
| </body> |
| </html> |
