JFreeChart Multiple HTML Injection Vulnerabilities

Bugtraq ID:	26752
Class:	Input Validation Error
CVE:	CVE-2007-6306
Remote:	Yes
Local:	No
Published:	Dec 06 2007 12:00AM
Updated:	Aug 13 2008 07:16PM
Credit:	Chad Loder discovered these vulnerabilities.
Vulnerable:	RedHat Red Hat Network Satellite (for RHEL 4) 5.1 RedHat Network Satellite (for RHEL 4) 4.2 Red Hat Red Hat Network Satellite Server 5.0 Red Hat Network Satellite (for RHEL 3) 4.2 Red Hat JBoss Enterprise Application Platform 4.2 EL4 JFreeChart JFreeChart 1.0.8
Not Vulnerable:

JFreeChart Multiple HTML Injection Vulnerabilities

JFreeChart is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input.

Attacker-supplied HTML and script code could execute in the context of the affected website, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

These issues affect JFreeChart 1.0.8; other versions may be affected as well.

JFreeChart Multiple HTML Injection Vulnerabilities

Attackers can exploit these issues by enticing an unsuspecting user to visit a malicious website.

JFreeChart Multiple HTML Injection Vulnerabilities

Solution:
The vendor has released an SVN fix to address these issues. Please see the references for more information.