Lxlabs HyperVM Cross-Site Scripting Vulnerability
BID:26751
Info
Lxlabs HyperVM Cross-Site Scripting Vulnerability
| Bugtraq ID: | 26751 |
| Class: | Input Validation Error |
| CVE: |
CVE-2007-6287 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 07 2007 12:00AM |
| Updated: | Dec 13 2007 08:32PM |
| Credit: | Sascha discovered this issue. |
| Vulnerable: |
Lxlabs HyperVM 2.0 |
| Not Vulnerable: |
Lxlabs HyperVM 2.0.972 |
Discussion
Lxlabs HyperVM Cross-Site Scripting Vulnerability
HyperVM is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
This issue affects HyperVM 2.0.
HyperVM is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
This issue affects HyperVM 2.0.
Exploit / POC
Lxlabs HyperVM Cross-Site Scripting Vulnerability
An attacker may exploit this issue by enticing an unsuspecting user to follow a malicious URI.
An attacker may exploit this issue by enticing an unsuspecting user to follow a malicious URI.
Solution / Fix
Lxlabs HyperVM Cross-Site Scripting Vulnerability
Solution:
Reports indicate that the vendor released HyperVM 2.0.972 to address this issue. Symantec was unable to confirm this information. Please contact the vendor for information on obtaining and applying fixes.
Please see the references for more information.
Solution:
Reports indicate that the vendor released HyperVM 2.0.972 to address this issue. Symantec was unable to confirm this information. Please contact the vendor for information on obtaining and applying fixes.
Please see the references for more information.