Ipswitch Whatsup Gold Cross-Site Scripting Vulnerability

Bugtraq ID:	14799
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 09 2005 12:00AM
Updated:	Sep 09 2005 12:00AM
Credit:	Dennis Rand is credited with the discovery of this vulnerability.
Vulnerable:	Ipswitch WhatsUp Gold 8.0 4
Not Vulnerable:

Ipswitch Whatsup Gold Cross-Site Scripting Vulnerability

Ipswitch Whatsup Gold is prone to a file disclosure vulnerability. This is due to a lack of proper sanitization of user-supplied input.

A remote attacker may exploit this vulnerability to reveal files that contain potentially sensitive information. Information that is harvested in this manner may then be used to aid in further attacks against the software and the computer that is hosting the software.

Ipswitch Whatsup Gold Cross-Site Scripting Vulnerability

No exploit is required.

Ipswitch Whatsup Gold Cross-Site Scripting Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Ipswitch Whatsup Gold Cross-Site Scripting Vulnerability

References:

• Access to view source code of all files, with uppercase extensions (Dennis Rand)
  
• Ipswitch Homepage (Ipswitch)