3Com OfficeConnect Gigabit VPN Firewall (3CREVF100-73) Cross Site Scripting Vulnerability

Bugtraq ID:	43236
Class:	Input Validation Error
CVE:	CVE-2010-3010
Remote:	Yes
Local:	No
Published:	Sep 15 2010 12:00AM
Updated:	Sep 20 2010 06:11PM
Credit:	Jonathan Grier
Vulnerable:
Not Vulnerable:

3Com OfficeConnect Gigabit VPN Firewall (3CREVF100-73) Cross Site Scripting Vulnerability

3Com OfficeConnect Gigabit VPN Firewall (3CREVF100-73) is prone to a cross-site scripting vulnerability because the device's web interface fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

3Com OfficeConnect Gigabit VPN Firewall (3CREVF100-73) with firmware versions prior to 1.0.13 are vulnerable.

3Com OfficeConnect Gigabit VPN Firewall (3CREVF100-73) Cross Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

3Com OfficeConnect Gigabit VPN Firewall (3CREVF100-73) Cross Site Scripting Vulnerability

Solution:
Vendor updates are available. Please see the references for more information.

3Com OfficeConnect Gigabit VPN Firewall (3CREVF100-73) Cross Site Scripting Vulnerability

References:

• 3Com OfficeConnect Gigabit VPN Firewall (3CREVF100-73) - Homepage (3Com)
  
• 3Com OfficeConnect Gigabit VPN Firewall �?? Release Notes v1.0.13 (3Com)
  
• HPSBGN02577 SSRT100224 rev.1 - 3Com OfficeConnect Gigabit VPN Firewall (3CREVF10 (HP)