Attachmate Reflection for the Web Cross Site Scripting Vulnerability

Bugtraq ID:	44123
Class:	Input Validation Error
CVE:	CVE-2010-4146
Remote:	Yes
Local:	No
Published:	Oct 14 2010 12:00AM
Updated:	Apr 13 2015 09:02PM
Credit:	The vendor reported this issue.
Vulnerable:	Attachmate Reflection for the Web 2008 R2 Attachmate Reflection for the Web 2008 R1 Attachmate Reflection for the Web 9.6
Not Vulnerable:

Attachmate Reflection for the Web Cross Site Scripting Vulnerability

Reflection for the Web is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

The issue affects the following:

Reflection for the Web 2008 R1
Reflection for the Web 2008 R2
Reflection for the Web 9.6 and prior

Attachmate Reflection for the Web Cross Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

Attachmate Reflection for the Web Cross Site Scripting Vulnerability

Solution:
The vendor has released an update to address the issue. Please see the references for more information.