Sun Java System Messaging Server Cross-Site Scripting Vulnerability

Bugtraq ID:	32285
Class:	Input Validation Error
CVE:	CVE-2008-5098
Remote:	Yes
Local:	No
Published:	Nov 12 2008 12:00AM
Updated:	May 07 2015 05:21PM
Credit:	Seth Hall of Ohio State University
Vulnerable:	Sun Java System Messaging Server 6.3 Sun Java System Messaging Server 6.2
Not Vulnerable:

Sun Java System Messaging Server Cross-Site Scripting Vulnerability

Sun Java System Messaging Server is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Sun Java System Messaging Server 6.2 and 6.3 are vulnerable.

Sun Java System Messaging Server Cross-Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

Sun Java System Messaging Server Cross-Site Scripting Vulnerability

Solution:
The vendor has released fixes. Please see the references for more information.

Sun Java System Messaging Server Cross-Site Scripting Vulnerability

References:

• Sun Java System Messaging Server Homepage (Sun)
  
• Solution 242186 : Cross-Site Scripting (XSS) Vulnerability in Sun Java Messag (Sun)