FuseTalk AuthError.CFM Multiple Cross Site Scripting Vulnerabilities

Bugtraq ID:	24564
Class:	Input Validation Error
CVE:	CVE-2007-3339
Remote:	Yes
Local:	No
Published:	Jun 20 2007 12:00AM
Updated:	May 07 2015 05:37PM
Credit:	Ivan Almuina is credited with the discovery of these vulnerabilities.
Vulnerable:	FuseTalk Inc. FuseTalk 4.0 FuseTalk Inc. FuseTalk 3.0 FuseTalk Inc. FuseTalk 2.0
Not Vulnerable:

FuseTalk AuthError.CFM Multiple Cross Site Scripting Vulnerabilities

FuseTalk is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

An attacker can exploit these issues to steal cookie-based authentication credentials and launch other attacks.

FuseTalk AuthError.CFM Multiple Cross Site Scripting Vulnerabilities

To exploit these issues, an attacker must entice an unsuspecting victim into following a malicious URI.

The following examples are available:

http://www.example.com/forum/include/error/autherror.cfm?errorcode=1
&FTVAR_LINKP=[xss]

http://www.example.com/blog/forum/include/error/autherror.cfm?errorcode=1
&FTVAR_URLP=[xss]

FuseTalk AuthError.CFM Multiple Cross Site Scripting Vulnerabilities

Solution:
Please contact the vendor regarding the availability of a fix.

FuseTalk AuthError.CFM Multiple Cross Site Scripting Vulnerabilities

References:

• FuseTalk Homepage (FuseTalk Inc.)
  
• fusetalk CSS (autherror.cfm) (Ivan Almuina)