HP Insight Control Performance Management Cross-Site Scripting Vulnerability

Bugtraq ID:	44585
Class:	Input Validation Error
CVE:	CVE-2010-4030
Remote:	Yes
Local:	No
Published:	Nov 01 2010 12:00AM
Updated:	Nov 01 2010 12:00AM
Credit:	HP.
Vulnerable:
Not Vulnerable:

HP Insight Control Performance Management Cross-Site Scripting Vulnerability

HP Insight Control Performance Management for Windows is prone to an unspecified cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and to launch other attacks.

Versions prior to HP Insight Control Performance Management 6.2 on Microsoft Windows are vulnerable.

HP Insight Control Performance Management Cross-Site Scripting Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

HP Insight Control Performance Management Cross-Site Scripting Vulnerability

Solution:
Updates are available. Please see the references for more information.

HP Insight Control Performance Management Cross-Site Scripting Vulnerability

References:

• HP Homepage (HP)
  
• HPSBMA02602 SSRT100317 rev.1 - HP Insight Control Performance Management for Win ([email protected])