CruxPA Multiple HTML Injection Vulnerabilities

Bugtraq ID:	41495
Class:	Input Validation Error
CVE:	CVE-2010-2718
Remote:	Yes
Local:	No
Published:	Jul 08 2010 12:00AM
Updated:	Apr 13 2015 09:02PM
Credit:	High-Tech Bridge SA
Vulnerable:	Crux Software CruxPA 2.00
Not Vulnerable:

CruxPA Multiple HTML Injection Vulnerabilities

CruxPA is prone to multiple HTML-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

CruxPA 2.00 is vulnerable; prior versions may also be affected.

CruxPA Multiple HTML Injection Vulnerabilities

Attackers can use a browser to exploit these issues.

CruxPA Multiple HTML Injection Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

CruxPA Multiple HTML Injection Vulnerabilities

References:

• CruxPA Product Page (Crux Software)
  
• XSS vulnerability in CruxPA (High-Tech Bridge SA)
  
• XSS vulnerability in CruxPA (High-Tech Bridge SA)
  
• XSS vulnerability in CruxPA (High-Tech Bridge SA)