Futomi CGI Cafe Access Analyzer CGI Cross-Site Scripting Vulnerability

Bugtraq ID:	43142
Class:	Input Validation Error
CVE:	CVE-2010-2366
Remote:	Yes
Local:	No
Published:	Sep 10 2010 12:00AM
Updated:	Sep 10 2010 12:00AM
Credit:	Katsumi Kobayashi, NRI Secure Technologies.
Vulnerable:	Futomi's CGI Cafe Access Analyzer CGI Professional 0 Futomi's CGI Cafe Access Analyzer CGI 4.0.2 Futomi's CGI Cafe Access Analyzer CGI 4.0.1
Not Vulnerable:

Futomi CGI Cafe Access Analyzer CGI Cross-Site Scripting Vulnerability

Futomi CGI Cafe Access Analyzer CGI is prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to execute arbitrary HTML and script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

The following are vulnerable:

Access Analyzer CGI Professional Version
Access Analyzer CGI Standard Version 4.0.2 and earlier

Futomi CGI Cafe Access Analyzer CGI Cross-Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting user to visit a malicious URI.

Futomi CGI Cafe Access Analyzer CGI Cross-Site Scripting Vulnerability

References:

• Futomi's CGI Cafe Analysis of High-Performance Access CGI (Futomi's CGI Cafe)
  
• JVN#35605523 (JPCERT)
  
• Vendor Homepage (Futomi CGI Cafe )