Cyber-Ark PIM Suite Password Vault Web Access Cross Site Scripting Vulnerability

Bugtraq ID:	47271
Class:	Input Validation Error
CVE:	CVE-2011-0459
Remote:	Yes
Local:	No
Published:	Apr 08 2011 12:00AM
Updated:	Apr 08 2011 12:00AM
Credit:	Reported by the vendor.
Vulnerable:	Cyber-Ark Software Password Vault Web Access 6.0 patch #2 Cyber-Ark Software Password Vault Web Access 5.5.patch #4 Cyber-Ark Software Password Vault Web Access 5.0
Not Vulnerable:	Cyber-Ark Software Password Vault Web Access 6.0 patch #3 Cyber-Ark Software Password Vault Web Access 5.5 patch #5

Cyber-Ark PIM Suite Password Vault Web Access Cross Site Scripting Vulnerability

Cyber-Ark PIM Suite Password Vault Web Access is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

The following versions are affected:

Password Vault Web Access version 5.0 and prior.
Password Vault Web Access version 5.5 patch #4 and prior.
Password Vault Web Access version 6.0 patch #2 and prior.

Cyber-Ark PIM Suite Password Vault Web Access Cross Site Scripting Vulnerability

To exploit this issue, an attacker must entice an unsuspecting user to follow a malicious URI.

Cyber-Ark PIM Suite Password Vault Web Access Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references for more information.

Cyber-Ark PIM Suite Password Vault Web Access Cross Site Scripting Vulnerability

References:

• JVN#11424086 - Password Vault Web Access vulnerable to cross-site scripting (JVN)
  
• JVNDB-2011-000023 - Password Vault Web Access vulnerable to cross-site scripting (JVN)
  
• Vendor Homepage (Cyber-Ark)