CA Arcot WebFort Versatile Authentication Server Cross Site Scripting Vulnerability

Bugtraq ID:	47587
Class:	Input Validation Error
CVE:	CVE-2011-1825
Remote:	Yes
Local:	No
Published:	Apr 26 2011 12:00AM
Updated:	Apr 26 2011 12:00AM
Credit:	Daniel Stirnimann, Compass Security AG.
Vulnerable:	CA Arcot WebFort Versatile Authentication Server 6.2.4
Not Vulnerable:	CA Arcot WebFort Versatile Authentication Server 6.2.5

CA Arcot WebFort Versatile Authentication Server Cross Site Scripting Vulnerability

CA Arcot WebFort Versatile Authentication Server is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to CA Arcot WebFort Versatile Authentication Server 6.2.5 are vulnerable.

CA Arcot WebFort Versatile Authentication Server Cross Site Scripting Vulnerability

To exploit this issue, an attacker must entice an unsuspecting user to follow a malicious URI.

CA Arcot WebFort Versatile Authentication Server Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references for more information.

CA Arcot WebFort Versatile Authentication Server Cross Site Scripting Vulnerability

References:

• CA Arcot WebFort (CA)
  
• CA20110426-01: Security Notice for CA Arcot WebFort Versatile Authentication Ser (CA)