CVE:CVE-2008-3328
CNNVD:CNNVD-200807-417
Trac是用Python编写的基于Web的事件跟踪系统。
Trac的Wiki引擎没有正确地验证某些参数便返回给了用户，远程攻击者可以通过向服务器提交恶意请求执行脚本注入或跨站脚本攻击。
solution:Upgrade edgewall_software trac to a higher version than 0.10.4,0.5,0.5.1,0.5.2,0.6,0.6.1,0.7,0.7.1,0.8,0.8.1,0.8.2,0.8.3,0.8.4,0.9,0.9.1,0.9.2,0.9.3,0.9.4,0.9.5,0.9.6,0.9b1,0.9b2,0.10,0.10.1,0.10.2,0.10.3,0.10.3.1,0.50.9,and avoid the version (,0.10.4],0.5,0.5.1,0.5.2,0.6,0.6.1,0.7,0.7.1,0.8,0.8.1,0.8.2,0.8.3,0.8.4,0.9,0.9.1,0.9.2,0.9.3,0.9.4,0.9.5,0.9.6,0.9b1,0.9b2,0.10,0.10.1,0.10.2,0.10.3,0.10.3.1,0.50.9