BID:22302

Sun Java System Access Manager Undisclosed Cross-Site Scripting Vulnerability

Info

Sun Java System Access Manager Undisclosed Cross-Site Scripting Vulnerability

Bugtraq ID:	22302
Class:	Input Validation Error
CVE:	CVE-2007-0628
Remote:	Yes
Local:	No
Published:	Jan 29 2007 12:00AM
Updated:	May 12 2015 07:35PM
Credit:	The vendor disclosed this issue.
Vulnerable:	Sun Java System Access Manager 7.0 2005Q4 Solaris x Sun Java System Access Manager 7.0 2005Q4 Solaris S Sun Java System Access Manager 7.0 2005Q4 Linux Sun Java System Access Manager 6.2 Sun Java System Access Manager 6.1 Sun Java System Access Manager 6 2005Q1 Solaris x86 Sun Java System Access Manager 6 2005Q1 Solaris SPA Sun Java System Access Manager 6 2005Q1 Linux

Not Vulnerable:

Discussion

Sun Java System Access Manager Undisclosed Cross-Site Scripting Vulnerability

Sun Java System Access Manager is prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Exploit / POC

Sun Java System Access Manager Undisclosed Cross-Site Scripting Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

Solution / Fix

Sun Java System Access Manager Undisclosed Cross-Site Scripting Vulnerability

Solution:
The vendor has released patches to address this issue. Please see the references for more information.

Sun Java System Access Manager 6 2005Q1 Solaris SPA