CGIWrap Error Page Handling Cross Site Scripting Vulnerability

Bugtraq ID:	29811
Class:	Input Validation Error
CVE:	CVE-2008-2852
Remote:	Yes
Local:	No
Published:	Jun 19 2008 12:00AM
Updated:	Oct 20 2008 11:06PM
Credit:	Hirohisa Yamaguchi
Vulnerable:	Turbolinux Appliance Server Workgroup Edition 1.0 Turbolinux Appliance Server Hosting Edition 1.0 Turbolinux Appliance Server 1.0 Workgroup Edition Turbolinux Appliance Server 1.0 Hosting Edition Turbolinux Appliance Server 3.0 x64 Turbolinux Appliance Server 3.0 Turbolinux Appliance Server 2.0 Nathan Neulinger CGIWrap 3.7 Nathan Neulinger CGIWrap 3.6.4 Nathan Neulinger CGIWrap 3.6.3 Nathan Neulinger CGIWrap 3.6.2 Nathan Neulinger CGIWrap 3.6.1 Nathan Neulinger CGIWrap 3.6 Nathan Neulinger CGIWrap 3.5 Nathan Neulinger CGIWrap 4.0
Not Vulnerable:	Nathan Neulinger CGIWrap 4.1

CGIWrap Error Page Handling Cross Site Scripting Vulnerability

CGIWrap is prone to a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Versions prior to CGIWrap 4.1 are vulnerable.

CGIWrap Error Page Handling Cross Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.

CGIWrap Error Page Handling Cross Site Scripting Vulnerability

Solution:
The vendor has released an update. Please the references for more information.

CGIWrap Error Page Handling Cross Site Scripting Vulnerability

References:

• CGIWrap Changelog (CGIWrap)
  
• CGIWrap Homepage (CGIWrap)
  
• CGIWrap error page cross-site scripting vulnerability (Hirohisa Yamaguchi)