Apache Jackrabbit 'q' Parameter Multiple Cross Site Scripting Vulnerabilities

Bugtraq ID:	33360
Class:	Input Validation Error
CVE:	CVE-2009-0026
Remote:	Yes
Local:	No
Published:	Jan 20 2009 12:00AM
Updated:	Jan 20 2009 04:52PM
Credit:	Red Hat Security Response Team
Vulnerable:	Apache Apache Jackrabbit 1.5 Apache Apache Jackrabbit 1.4
Not Vulnerable:	Apache Apache Jackrabbit 1.5.2

Apache Jackrabbit 'q' Parameter Multiple Cross Site Scripting Vulnerabilities

Apache Jackrabbit is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to Apache Jackrabbit 1.5.2 are vulnerable.

Apache Jackrabbit 'q' Parameter Multiple Cross Site Scripting Vulnerabilities

To exploit these issues, an attacker must entice an unsuspecting victim into following a malicious URI.

The following example URIs are available:

• /data/vulnerabilities/exploits/33360.txt

Apache Jackrabbit 'q' Parameter Multiple Cross Site Scripting Vulnerabilities

Solution:
Updates are available; please see the references for more information.

Apache Jackrabbit 'q' Parameter Multiple Cross Site Scripting Vulnerabilities

References:

• [#JCR-1925] CVE-2009-0026: Cross site scripting issues in webapp - ASF JIRA (Apache Software Foundation)
  
• Apache Jackrabbit Homepage (Apache Software Foundation)
  
• Release Notes -- Apache Jackrabbit -- Version 1.5.2 (Apache Software Foundation)
  
• [ANNOUNCE] Apache Jackrabbit 1.5.2 released ("Jukka Zitting" )