======================================================================

DEVWERKS SECURITY ADVISORY www.devwerks.net

======================================================================

devWerks Advisory ID: DW-2016-003

Application: Collabtive <= 2.1.1
     Vendor: Open Dynamics
    Subject: Cross-site Scripting - XSS

     Author: Johannes Schroeter (j.schroeter@devwerks.net)
       Date: 2016-10-07
       
======================================================================
Overview:

Collabtive is web-based project management software.
The project was started in November 2007. It is open source software and 
provides an alternative to proprietary tools like Basecamp. Collabtive is 
written in PHP and JavaScript.

devWerks discovered a security flaw in the Collabtive
web application, which allows execution of malicious code.

======================================================================
Details:

This particular vulnerability exists within the applications profile view
function and is due to improper input sanitization. For example, javascript
could be added and because of a lack of input sanitization/validation, the 
javascript would execute within the context of the Collabtive web application.

======================================================================
Timeline:

2016-04-01: Vendor notified
2016-04-01: Vendor response
2016-04-03: Vulnerability details sent to vendor 
2016-04-04: Vendor asked for more details
2016-04-04: More details sent to vendor
2016-10-07: No response from vendor, public release of this advisory

======================================================================
Recommendation:

No patch available.

Contact us for patch.

======================================================================
References:

http://collabtive.o-dyn.de
http://www.o-dyn.de
http://devwerks.net