Apache Tiles Cross Site Scripting And Information Disclosure Vulnerabilities

Bugtraq ID:	34657
Class:	Input Validation Error
CVE:	CVE-2009-1275
Remote:	Yes
Local:	No
Published:	Dec 19 2008 12:00AM
Updated:	Apr 22 2009 03:36PM
Credit:	The vendor
Vulnerable:	Apache Apache Tiles 2.1.1 Apache Apache Tiles 2.1
Not Vulnerable:	Apache Apache Tiles 2.1.2

Apache Tiles Cross Site Scripting And Information Disclosure Vulnerabilities

Apache Tiles is prone to cross-site scripting and information-disclosure vulnerabilities because it fails to sanitize user-supplied input.

An attacker may leverage these issues to obtain potentially sensitive information and to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

These issues affect Apache Tiles 2.1.0 and 2.1.1.

Apache Tiles Cross Site Scripting And Information Disclosure Vulnerabilities

The attacker must entice unsuspecting users to follow a malicious URI.

Apache Tiles Cross Site Scripting And Information Disclosure Vulnerabilities

Solution:
The vendor released Apache Tiles 2.1.2 to address these issues. Please see the references for more information.

Apache Tiles Cross Site Scripting And Information Disclosure Vulnerabilities

References:

• Apache Tiles (Apache Software Foundation)
  
• EL expressions in JSP using some Tiles JSP tags are evaluated twice (Apache Software Foundation)
  
• EL expressions in JSP using some Tiles JSP tags are evaluated twice. (Apache Software Foundation)