Cerberus Content Management System 'cerberus_user' Cookie Parameter HTML Injection Vulnerability

Bugtraq ID:	30416
Class:	Input Validation Error
CVE:	CVE-2008-3397
Remote:	Yes
Local:	No
Published:	Jul 23 2008 12:00AM
Updated:	May 07 2015 05:25PM
Credit:	Runesoft
Vulnerable:	Runesoft Cerberus Content Management System 3_1.3_0.9
Not Vulnerable:	Runesoft Cerberus Content Management System 3_1.4_0.9

Cerberus Content Management System 'cerberus_user' Cookie Parameter HTML Injection Vulnerability

Cerberus Content Management System is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

The issue affects Cerberus Content Management System 3_1.3_0.9; prior versions may also be vulnerable.

Cerberus Content Management System 'cerberus_user' Cookie Parameter HTML Injection Vulnerability

Attackers can use a browser to exploit this issue.

Cerberus Content Management System 'cerberus_user' Cookie Parameter HTML Injection Vulnerability

Solution:
The vendor has released an update. Please see the references for more information.

Cerberus Content Management System 'cerberus_user' Cookie Parameter HTML Injection Vulnerability

References:

• Cerberus V3.9 (Runesoft)