Plumtree Corporate Portal Cross Site Scripting Vulnerability
BID:3799
Info
Plumtree Corporate Portal Cross Site Scripting Vulnerability
| Bugtraq ID: | 3799 |
| Class: | Input Validation Error |
| CVE: |
CVE-2002-0205 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 04 2002 12:00AM |
| Updated: | Jul 11 2009 09:56AM |
| Credit: | Discovered by Ed Moyle, and published on January 4, 2002. |
| Vulnerable: |
Plumtree Plumtree Corporate Portal 4.5 Plumtree Plumtree Corporate Portal 4.0 SP1 Plumtree Plumtree Corporate Portal 4.0 iSP1 Plumtree Plumtree Corporate Portal 4.0 i Plumtree Plumtree Corporate Portal 4.0 Plumtree Plumtree Corporate Portal 3.5 |
| Not Vulnerable: |
Plumtree Plumtree Corporate Portal 5.0 x |
Discussion
Plumtree Corporate Portal Cross Site Scripting Vulnerability
Plumtree Corporate Portal is a portal package designed to provide a comprehensive framework for a large corporate intranet. It includes support for personalization, and can be used to link together web and legacy applications and help distribute and organize information.
The script error.asp, used to process error messages, is vulnerable to a cross site scripting attack. A malicious user may link to this script and include javascript code in the Description parameter, which will then be executed in the context of the error page. Further information disclosure may result from exploitation of this vulnerability.
Plumtree Corporate Portal is a portal package designed to provide a comprehensive framework for a large corporate intranet. It includes support for personalization, and can be used to link together web and legacy applications and help distribute and organize information.
The script error.asp, used to process error messages, is vulnerable to a cross site scripting attack. A malicious user may link to this script and include javascript code in the Description parameter, which will then be executed in the context of the error page. Further information disclosure may result from exploitation of this vulnerability.
Exploit / POC
Plumtree Corporate Portal Cross Site Scripting Vulnerability
No exploit code is required to take advantage of this issue.
No exploit code is required to take advantage of this issue.
Solution / Fix
Plumtree Corporate Portal Cross Site Scripting Vulnerability
Solution:
Plumtree has acknowledged this issue and has included a fix in Corporate Portal 4.5 Service Pack 1. As well, Hotfix 6 has been released to address this issue in Corporate Portal 4.0 SP1. Reportedly this issue is documented in Plumtree supportnet article ID 11012, which is available from the Plumtree supportnet community.
Solution:
Plumtree has acknowledged this issue and has included a fix in Corporate Portal 4.5 Service Pack 1. As well, Hotfix 6 has been released to address this issue in Corporate Portal 4.0 SP1. Reportedly this issue is documented in Plumtree supportnet article ID 11012, which is available from the Plumtree supportnet community.
References
Plumtree Corporate Portal Cross Site Scripting Vulnerability
References:
References:
- Cross-Site Scripting in PlumTree? (Ed Moyle
- Plumtree Corporate Portal Product Homepage (Plumtree)
- Plumtree Technical Support Page (Plumtree)