IBM Lotus Quickr WYSIWYG Editors Unspecified Cross-Site Scripting Vulnerability

Bugtraq ID:	29175
Class:	Input Validation Error
CVE:	CVE-2008-2163
Remote:	Yes
Local:	No
Published:	May 12 2008 12:00AM
Updated:	May 07 2015 05:28PM
Credit:	IBM
Vulnerable:	IBM Lotus Quickr 8.1
Not Vulnerable:	IBM Lotus Quickr 8.1 Hotfix 5

IBM Lotus Quickr WYSIWYG Editors Unspecified Cross-Site Scripting Vulnerability

IBM Lotus Quickr is prone to an unspecified cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

The issue affects versions prior to Lotus Quickr 8.1 Hotfix 5.

IBM Lotus Quickr WYSIWYG Editors Unspecified Cross-Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting user into following a malicious URI.

IBM Lotus Quickr WYSIWYG Editors Unspecified Cross-Site Scripting Vulnerability

Solution:
The vendor has released fixes to address this issue. Please see the references for more information.

IBM Lotus Quickr WYSIWYG Editors Unspecified Cross-Site Scripting Vulnerability

References:

• Latest fixes for Lotus Quickr 8.1 services for Lotus Domino (IBM)
  
• Lotus Quickr (IBM)