CVE-2011-1401
ikiwiki before 3.20110328 does not ascertain whether the htmlscrubber plugin is enabled during...
ikiwiki before 3.20110328 does not ascertain whether the htmlscrubber plugin is enabled during processing of the "meta stylesheet" directive, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences in (1) the default stylesheet or (2) an alternate stylesheet.
Exploit likelihood
What each source reports
NVD Score used
ikiwiki before 3.20110328 does not ascertain whether the htmlscrubber plugin is enabled during processing of the "meta stylesheet" directive, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences in (1) the default stylesheet or (2) an alternate stylesheet.
- Record
CVE-2011-1401- CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
ikiwiki before 3.20110328 does not ascertain whether the htmlscrubber plugin is enabled during processing of the "meta stylesheet" directive, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences in (1) the default stylesheet or (2) an alternate stylesheet.
- Record
CVE-2011-1401- Updated
- 2026-11-02
EUVDEUVD-2011-1408 No score
ikiwiki before 3.20110328 does not ascertain whether the htmlscrubber plugin is enabled during processing of the "meta stylesheet" directive, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences in (1) the default stylesheet or (2) an alternate stylesheet.
- Record
EUVD-2011-1408- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6mvx-8cgw-xwh9 No score
ikiwiki before 3.20110328 does not ascertain whether the htmlscrubber plugin is enabled during...
ikiwiki before 3.20110328 does not ascertain whether the htmlscrubber plugin is enabled during processing of the "meta stylesheet" directive, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences in (1) the default stylesheet or (2) an alternate stylesheet.
- Record
GHSA-6mvx-8cgw-xwh9- Weakness
- CWE-79
- Updated
- 2026-11-02
OSV No score
ikiwiki before 3.20110328 does not ascertain whether the htmlscrubber plugin is enabled during processing of the "meta stylesheet" directive, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences in (1) the default stylesheet or (2) an alternate stylesheet.
- Record
CVE-2011-1401- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-1401 No score
ikiwiki before 3.20110328 does not ascertain whether the htmlscrubber plugin is enabled during processing of the "meta stylesheet" directive, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences in (1) the default stylesheet or (2) an alternate stylesheet.
- Record
DEBIAN-CVE-2011-1401- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10860-1 No score
ikiwiki-3.20200202.3-2.7 on GA media
These are all security issues fixed in the ikiwiki-3.20200202.3-2.7 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10860-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ikiwikiDebian:12 |
before 3.20110328 | 3.20110328 |
ikiwikiDebian:13 |
before 3.20110328 | 3.20110328 |
ikiwikiDebian:14 |
before 3.20110328 | 3.20110328 |
ikiwikiDebian:5.0 |
before 2.53.6, plus listed versions 2.53.32.53.42.53.5 |
2.53.6 |
ikiwikiDebian:6.0 |
before 3.20100815.7, plus listed versions 3.20100815.6 |
3.20100815.7 |
ikiwikiopenSUSE:Tumbleweed From an advisory covering 14 CVEs |
before 3.20200202.3-2.7 | 3.20200202.3-2.7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-1401 is a low vulnerability (CVSS 3.5) in Ikiwiki, published April 8, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.06%, the 64th percentile. Fixed in ikiwiki 3.20110328.
References
debian.org/security/2011/dsa-2214
vupen.com/english/advisories/2011/1005
secunia.com/advisories/44137
ikiwiki.info/security
Show 19 moreShow less
securityfocus.com/bid/47285
lists.fedoraproject.org/pipermail/package-announce/2011-April/058403.html
nvd.nist.gov/vuln/detail/CVE-2011-1401
github.com/advisories/GHSA-6mvx-8cgw-xwh9
security-tracker.debian.org/tracker/CVE-2011-1401
suse.com/security/cve/CVE-2008-0169