HP Insight Control Power Management for Windows Cross-Site Scripting Vulnerability

Bugtraq ID:	44430
Class:	Input Validation Error
CVE:	CVE-2010-4023
Remote:	Yes
Local:	No
Published:	Oct 25 2010 12:00AM
Updated:	Oct 25 2010 12:00AM
Credit:	Hewlett-Packard Company, HP Software Security Response Team
Vulnerable:	HP HP Insight Control Power Management 6.0
Not Vulnerable:	HP HP Insight Control Power Management 6.2

HP Insight Control Power Management for Windows Cross-Site Scripting Vulnerability

HP Insight Control Power Management is prone to an unspecified cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and to launch other attacks.

Versions prior to HP Insight Control Power Management v6.2 on Microsoft Windows are vulnerable.

HP Insight Control Power Management for Windows Cross-Site Scripting Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

HP Insight Control Power Management for Windows Cross-Site Scripting Vulnerability

Solution:
Updates are available. Please see the references for more information.

HP Insight Control Power Management for Windows Cross-Site Scripting Vulnerability

References:

• HP Insight Control power management software - Homepage (HP)
  
• [security bulletin] HPSBMA02603 SSRT100319 rev.1 - HP Insight Control Power Mana ([email protected])
  
• HPSBMA02603 SSRT100319 rev.1 - HP Insight Control Power Management for Windows, (HP)