NetCommons Cross-Site Scripting Vulnerability

Bugtraq ID:	26328
Class:	Input Validation Error
CVE:	CVE-2007-5950
Remote:	Yes
Local:	No
Published:	Nov 05 2007 12:00AM
Updated:	Nov 20 2007 11:24PM
Credit:	The researcher responsible for discovering this vulnerability is not known.
Vulnerable:	NetCommons NetCommons 1.1.1 NetCommons NetCommons 1.0.10 NetCommons NetCommons 1.0.9 NetCommons NetCommons 1.0.8
Not Vulnerable:	NetCommons NetCommons 1.1.2 NetCommons NetCommons 1.0.11

NetCommons Cross-Site Scripting Vulnerability

NetCommons is prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

These versions are affected:

NetCommons 1.0.x branch prior to 1.0.11
NetCommons 1.1.x branch prior to 1.1.2

NetCommons Cross-Site Scripting Vulnerability

Attackers can exploit this issue via a browser.

NetCommons Cross-Site Scripting Vulnerability

Solution:
The vendor has released NetCommons 1.0.11 and 1.1.2 to address this issue; please see the references for details.

NetCommons Cross-Site Scripting Vulnerability

References:

• NetCommons 1.0.11 (NetCommons)
  
• NetCommons Home Page (NetCommons)
  
• NetCommons1.1.2 (NetCommons)