IBM Lotus Sametime Server WebRunMenuFrame Cross-Site Scripting Vulnerability

Bugtraq ID:	26734
Class:	Input Validation Error
CVE:	CVE-2007-6295
Remote:	Yes
Local:	No
Published:	Dec 05 2007 12:00AM
Updated:	Dec 19 2007 05:01PM
Credit:	The vendor disclosed this issue.
Vulnerable:	IBM Lotus Sametime 7.5.1 IBM Lotus Sametime 3.1 IBM Lotus Sametime 3.0 a IBM Lotus Sametime 3.0 IBM Lotus Sametime 7.5 IBM Lotus Sametime 7.0
Not Vulnerable:	IBM Lotus Sametime 8.0

IBM Lotus Sametime Server WebRunMenuFrame Cross-Site Scripting Vulnerability

IBM Lotus Sametime Server is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects versions prior to Sametime Server 8.0.

IBM Lotus Sametime Server WebRunMenuFrame Cross-Site Scripting Vulnerability

An attacker may exploit this issue by enticing an unsuspecting user to follow a malicious URI.

IBM Lotus Sametime Server WebRunMenuFrame Cross-Site Scripting Vulnerability

Solution:
The vendor released updates to address this issue. Contact the vendor for information on obtaining and applying fixes.

Please see the references for more information.

IBM Lotus Sametime Server WebRunMenuFrame Cross-Site Scripting Vulnerability

References:

• IBM Lotus Sametime Product Page (IBM)
  
• IBM Lotus Sametime SPR #IHAS77TRYF (IBM )