VTLS Web Gateway Searchtype Parameter Cross-Site Scripting Vulnerability

Bugtraq ID:	26419
Class:	Input Validation Error
CVE:	CVE-2007-5993
Remote:	Yes
Local:	No
Published:	Nov 13 2007 12:00AM
Updated:	Nov 23 2007 08:24PM
Credit:	Jesus Olmos Gonzalez is credited with the discovery of this vulnerability.
Vulnerable:	VTLS Web Gateway 48.1
Not Vulnerable:	VTLS Web Gateway 48.1.1

VTLS Web Gateway Searchtype Parameter Cross-Site Scripting Vulnerability

Web Gateway is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker to steal cookie-based authentication credentials and to launch other attacks.

This issue affects versions prior to Web Gateway 48.1.1.

VTLS Web Gateway Searchtype Parameter Cross-Site Scripting Vulnerability

Attackers can exploit this issue via a browser.

The following proof-of-concept URI is available:

• /data/vulnerabilities/exploits/26419.html

VTLS Web Gateway Searchtype Parameter Cross-Site Scripting Vulnerability

Solution:
The vendor has released an update to address this issue. Please see the references for more information.

VTLS Web Gateway Searchtype Parameter Cross-Site Scripting Vulnerability

References:

• Web Gateway Homepage (VTLS)
  
• [ISecAuditors Security Advisories] VTLS.web.gateway cgi is vulnerable to XSS (ISecAuditors Security Advisories )