Woodstock 404 Error Page Cross Site Scripting Vulnerability

Bugtraq ID:	34829
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 05 2009 12:00AM
Updated:	May 06 2009 06:16PM
Credit:	Digital Security Research Group [DSecRG]
Vulnerable:	Sun Woodstock 4.2 Sun Glassfish Enterprise Server 2.1 Sun Glassfish 0
Not Vulnerable:

Woodstock 404 Error Page Cross Site Scripting Vulnerability

Woodstock is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to steal cookie-based authentication credentials.

Woodstock 4.2 is vulnerable; other versions may also be affected.

Woodstock 404 Error Page Cross Site Scripting Vulnerability

An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.

The following example URI is available:

• /data/vulnerabilities/exploits/34829.txt

Woodstock 404 Error Page Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references for details.

Woodstock 404 Error Page Cross Site Scripting Vulnerability

References:

• CVS update: /woodstock/webui/src/runtime/com/sun/webui/theme/ThemeServlet.java ([email protected])
  
• Re: [DSECRG] Sun Glassfish Multiple Security Vulnerabilities (Ken Paulsen )
  
• Woodstock Homepage (Sun)
  
• [DSECRG-09-038] Sun Glassfish Woodstock Project - Linked XSS Vulnerability ("Digital Security Research Group \[DSecRG\]" )