Hitachi Multiple Business Logic Products Unspecified Cross-Site Scripting Vulnerability
BID:35793
Info
Hitachi Multiple Business Logic Products Unspecified Cross-Site Scripting Vulnerability
| Bugtraq ID: | 35793 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 24 2009 12:00AM |
| Updated: | Dec 14 2010 03:14PM |
| Credit: | The vendor disclosed this issue. |
| Vulnerable: |
Hitachi Electronic Form Workflow Standard Set 0 Hitachi Electronic Form Workflow Set 0 Hitachi Electronic Form Workflow Professional Set 0 Hitachi Electronic Form Workflow Professional Library Set 0 Hitachi Electronic Form Workflow Developer Set 0 Hitachi Electronic Form Workflow Developer Client Set 0 Hitachi Business Logic - Container Business Logic - Hitachi Business Logic - Container Business Logic - |
| Not Vulnerable: | |
Discussion
Hitachi Multiple Business Logic Products Unspecified Cross-Site Scripting Vulnerability
Multiple Hitachi Business Logic products are prone to a cross-site scripting vulnerability because they fail to properly sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
The following products are affected:
Hitachi Business Logic - Container
Hitachi Business Logic - Container 2
Electronic Form Workflow - Standard Set
Electronic Form Workflow - Professional Library Set
Electronic Form Workflow - Developer Client Set
Electronic Form Workflow Set
Electronic Form Workflow - Professional Set
Electronic Form Workflow - Developer Set
Multiple Hitachi Business Logic products are prone to a cross-site scripting vulnerability because they fail to properly sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
The following products are affected:
Hitachi Business Logic - Container
Hitachi Business Logic - Container 2
Electronic Form Workflow - Standard Set
Electronic Form Workflow - Professional Library Set
Electronic Form Workflow - Developer Client Set
Electronic Form Workflow Set
Electronic Form Workflow - Professional Set
Electronic Form Workflow - Developer Set
Exploit / POC
Hitachi Multiple Business Logic Products Unspecified Cross-Site Scripting Vulnerability
An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.
An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.
Solution / Fix
Hitachi Multiple Business Logic Products Unspecified Cross-Site Scripting Vulnerability
Solution:
The vendor has released an advisory and updates. Please see the referenced advisory for details.
Solution:
The vendor has released an advisory and updates. Please see the referenced advisory for details.
References
Hitachi Multiple Business Logic Products Unspecified Cross-Site Scripting Vulnerability
References:
References: