OpenEdit Digital Asset Management (DAM) 'name' Parameter HTML Injection Vulnerability

Bugtraq ID:	33064
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 30 2008 12:00AM
Updated:	Jan 02 2009 07:42PM
Credit:	Russ McRee
Vulnerable:	OpenEdit Digital Asset Management (DAM) 0
Not Vulnerable:

OpenEdit Digital Asset Management (DAM) 'name' Parameter HTML Injection Vulnerability

OpenEdit Digital Asset Management (DAM) is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

OpenEdit Digital Asset Management (DAM) 'name' Parameter HTML Injection Vulnerability

Attackers can use a web browser to exploit this issue.

OpenEdit Digital Asset Management (DAM) 'name' Parameter HTML Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

OpenEdit Digital Asset Management (DAM) 'name' Parameter HTML Injection Vulnerability

References:

• OpenEdit Digital Asset Management Homepage (OpenEdit)