ActiveWeb Contentserver Mimetype Name HTML Injection Vulnerability

Bugtraq ID:	24896
Class:	Input Validation Error
CVE:	CVE-2007-3014
Remote:	Yes
Local:	No
Published:	Jul 13 2007 12:00AM
Updated:	May 07 2015 05:37PM
Credit:	RedTeam Pentesting is credited with the discovery of this vulnerability.
Vulnerable:	Active Web Softwares contentserver 5.6.2929
Not Vulnerable:

ActiveWeb Contentserver Mimetype Name HTML Injection Vulnerability

activeWeb contentserver is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input data.

Exploiting this issue may allow an attacker to execute HTML and script code in the context of the affected site, to steal cookie-based authentication credentials, or to control how the site is rendered to the user; other attacks are also possible.

Reports indicate that versions prior to contentserver 5.6.2964 are vulnerable to this issue.

ActiveWeb Contentserver Mimetype Name HTML Injection Vulnerability

Attackers can use a browser to exploit this issue.

ActiveWeb Contentserver Mimetype Name HTML Injection Vulnerability

Solution:
Reports indicate that contentserver 5.6.2964 is not affected by these issues, but Symantec was unable to verify this information. Please contact the vendor for more information.

ActiveWeb Contentserver Mimetype Name HTML Injection Vulnerability

References:

• ActiveWeb Contentserver CMS Multiple Cross Site Scriptings (RedTeam Pentesting GmbH)
  
• contentserver (activeWeb)