Groupmax World Wide Web Cross-Site Scripting And Directory Traversal Vulnerabilities
BID:11773
Info
Groupmax World Wide Web Cross-Site Scripting And Directory Traversal Vulnerabilities
| Bugtraq ID: | 11773 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 29 2004 12:00AM |
| Updated: | Nov 29 2004 12:00AM |
| Credit: | The vendor disclosed these vulnerabilities. |
| Vulnerable: |
Hitachi Groupmax World Wide Web Desktop for Jichitai 06-52 Hitachi Groupmax World Wide Web Desktop for Jichitai 06-51 Hitachi Groupmax World Wide Web Desktop 06-52-/B Hitachi Groupmax World Wide Web Desktop 06-52 Hitachi Groupmax World Wide Web Desktop 06-51-/C Hitachi Groupmax World Wide Web Desktop 06-51-/B Hitachi Groupmax World Wide Web Desktop 06-51 Hitachi Groupmax World Wide Web Desktop 06-50-/C Hitachi Groupmax World Wide Web Desktop 06-50-/B Hitachi Groupmax World Wide Web Desktop 06-00 Hitachi Groupmax World Wide Web Desktop 05-11-/J Hitachi Groupmax World Wide Web Desktop 05-11-/I Hitachi Groupmax World Wide Web Desktop 05-11-/F Hitachi Groupmax World Wide Web Desktop 05-00 Hitachi Groupmax World Wide Web 03-11-/B Hitachi Groupmax World Wide Web 03-10-/H Hitachi Groupmax World Wide Web 03-00 Hitachi Groupmax World Wide Web 02-31-/I Hitachi Groupmax World Wide Web 02-20-/A Hitachi Groupmax World Wide Web 02-20 Hitachi Groupmax World Wide Web 02-00 |
| Not Vulnerable: |
Hitachi Groupmax World Wide Web Desktop 06-52-/C Hitachi Groupmax World Wide Web 06-52-/C |
Discussion
Groupmax World Wide Web Cross-Site Scripting And Directory Traversal Vulnerabilities
It is reported that Groupmax World Wide Web is susceptible to both a cross-site scripting vulnerability and a directory traversal vulnerability. These vulnerabilities are due to a failure of the application to properly sanitize user-supplied input.
The cross-site scripting issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.
The directory traversal vulnerability allows remote attackers to retrieve the contents of potentially sensitive files with the privileges of the web server. Reportedly, only files with an 'html' extension are retrievable.
Both of these vulnerabilities reportedly require attackers to successfully authenticate to the server prior to exploitation.
It is reported that Groupmax World Wide Web is susceptible to both a cross-site scripting vulnerability and a directory traversal vulnerability. These vulnerabilities are due to a failure of the application to properly sanitize user-supplied input.
The cross-site scripting issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.
The directory traversal vulnerability allows remote attackers to retrieve the contents of potentially sensitive files with the privileges of the web server. Reportedly, only files with an 'html' extension are retrievable.
Both of these vulnerabilities reportedly require attackers to successfully authenticate to the server prior to exploitation.
Exploit / POC
Groupmax World Wide Web Cross-Site Scripting And Directory Traversal Vulnerabilities
An exploit is not required.
An exploit is not required.
Solution / Fix
Groupmax World Wide Web Cross-Site Scripting And Directory Traversal Vulnerabilities
Solution:
The vendor has released an advisory along with fixes to address these issues. Users of affected packages should contact the vendor for further information on obtaining fixes.
Solution:
The vendor has released an advisory along with fixes to address these issues. Users of affected packages should contact the vendor for further information on obtaining fixes.
References
Groupmax World Wide Web Cross-Site Scripting And Directory Traversal Vulnerabilities
References:
References: