Websense Reporting Tools Login Page Cross-Site Scripting Vulnerability

Bugtraq ID:	26793
Class:	Input Validation Error
CVE:	CVE-2007-6312
Remote:	Yes
Local:	No
Published:	Dec 10 2007 12:00AM
Updated:	Jan 03 2008 02:10PM
Credit:	Dave Lewis of Liquidmatrix Security Digest is credited with the discovery of this vulnerability.
Vulnerable:	Websense Websense Web Security Suite 6.3.1 Websense Websense Web Security Suite 6.3 Websense Websense Reporting Tools 6.3.1 Websense Websense Reporting Tools 6.3 Websense Websense Enterprise 6.3.1 Websense Websense Enterprise 6.3
Not Vulnerable:

Websense Reporting Tools Login Page Cross-Site Scripting Vulnerability

Websense Reporting Tools is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Websense Reporting Tools Login Page Cross-Site Scripting Vulnerability

An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.

Websense Reporting Tools Login Page Cross-Site Scripting Vulnerability

Solution:
The vendor has released an update to address this issue. Please see the references for more information.

Websense Reporting Tools Login Page Cross-Site Scripting Vulnerability

References:

• Advisory: Websense XSS Vulnerability (Dave Lewis)
  
• Websense Homepage (Websense)
  
• Websense Knowledgebase Reference Number: 1840 (Websense)
  
• Advisory: Websense XSS Vulnerability ("Liquidmatrix Security Digest" )