IBM Lotus Sametime Client Chat Message Cross-Site Scripting Vulnerability

Bugtraq ID:	27316
Class:	Input Validation Error
CVE:	CVE-2008-0354
Remote:	Yes
Local:	No
Published:	Jan 16 2008 12:00AM
Updated:	May 07 2015 05:33PM
Credit:	Vikas Singhal is credited with the discovery of this issue.
Vulnerable:	IBM Lotus Sametime 7.5.1 IBM Lotus Sametime 7.5
Not Vulnerable:	IBM Lotus Sametime 8.0

IBM Lotus Sametime Client Chat Message Cross-Site Scripting Vulnerability

IBM Lotus Sametime Client is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the context of an unsuspecting user. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects Lotus Sametime Client 7.5 and 7.5.1.

IBM Lotus Sametime Client Chat Message Cross-Site Scripting Vulnerability

An attacker may exploit this issue by enticing an unsuspecting user to hover over a malicious URI.

IBM Lotus Sametime Client Chat Message Cross-Site Scripting Vulnerability

Solution:
The vendor released updates to address this issue. Contact the vendor for information on obtaining and applying fixes.

Please see the references for more information.

IBM Lotus Sametime Client Chat Message Cross-Site Scripting Vulnerability

References:

• IBM Lotus Sametime Product Page (IBM)
  
• Lotus Sametime Client Script Execution Vulnerability (Secunia)
  
• Potential Cross-Site Scripting (XSS) vulnerability in IBM Lotus Sametime client (IBM)