HP Business Availability Center and Business Service Management Cross Site Scripting Vulnerability

Bugtraq ID:	45944
Class:	Input Validation Error
CVE:	CVE-2011-0274
Remote:	Yes
Local:	No
Published:	Jan 19 2011 12:00AM
Updated:	Jan 19 2011 12:00AM
Credit:	Daniel Frye
Vulnerable:	HP Business Service Management 9.01 HP Business Availability Center 8.05 HP Business Availability Center 8.01 HP Business Availability Center 7.55
Not Vulnerable:

HP Business Availability Center and Business Service Management Cross Site Scripting Vulnerability

HP Business Availability Center (BAC) and Business Service Management (BSM) are prone to a cross-site scripting vulnerability because they fail to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

This issue affects the following software:

Business Availability Center (BAC) v7.55 and earlier on Windows and Solaris
Business Availability Center (BAC) v8.05 and earlier on Windows and Solaris
Business Service Management (BSM) v9.01 and earlier on Windows

HP Business Availability Center and Business Service Management Cross Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

HP Business Availability Center and Business Service Management Cross Site Scripting Vulnerability

Solution:
Updates are available; please see the references for more information.

HP Business Availability Center and Business Service Management Cross Site Scripting Vulnerability

References:

• Micro News Homepage (phptoys)
  
• HPSBMA02622 SSRT100342 rev.1 - HP Business Availability Center (BAC) and Busines (HP)