eFront Multiple Cross Site Scripting Vulnerabilities

Bugtraq ID:	40551
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 03 2010 12:00AM
Updated:	Jun 03 2010 12:00AM
Credit:	Mohammed Boumediane from VUPEN
Vulnerable:	eFront eFront 3.6.2 eFront eFront 3.6.1 eFront eFront 3.5.5 eFront eFront 3.6
Not Vulnerable:	eFront eFront 3.6.3 build 7400

eFront Multiple Cross Site Scripting Vulnerabilities

eFront is prone to multiple cross-site scripting vulnerabilities because the software fails to sufficiently sanitize user-supplied input

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to eFront 3.6.3 build 7400 are vulnerable.

eFront Multiple Cross Site Scripting Vulnerabilities

Attackers can exploit these issues by enticing an unsuspecting user to follow a malicious URI.

eFront Multiple Cross Site Scripting Vulnerabilities

Solution:
Updates are available. Please see the references for details.

eFront Multiple Cross Site Scripting Vulnerabilities

References:

• eFront Homepage (eFront)
  
• eFront Multiple Parameter Cross Site Scripting Vulnerabilities ('VUPEN Web Security' )