HP Insight Control Server Migration for Windows Cross-Site Scripting Vulnerability

Bugtraq ID:	40112
Class:	Input Validation Error
CVE:	CVE-2010-1557
Remote:	Yes
Local:	No
Published:	May 11 2010 12:00AM
Updated:	May 11 2010 12:00AM
Credit:	Hewlett-Packard Company, HP Software Security Response Team
Vulnerable:	HP Insight Control 0
Not Vulnerable:	HP Insight Control 6.0

HP Insight Control Server Migration for Windows Cross-Site Scripting Vulnerability

HP Insight Control is prone to an unspecified cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and to launch other attacks.

This issue affects HP Insight Control server migration 6.0 on Microsoft Windows.

HP Insight Control Server Migration for Windows Cross-Site Scripting Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

HP Insight Control Server Migration for Windows Cross-Site Scripting Vulnerability

Solution:
Updates are available. Please see the references for more information.

HP Insight Control Server Migration for Windows Cross-Site Scripting Vulnerability

References:

• HP Insight Control server migration Homepage (HP)
  
• Update for HP Insight Control server migration for Windows (HP)
  
• HP Insight Control Server Migration for Windows, Remote Cross Site Scripting (XS (HP)