RSA Data Loss Prevention (DLP) Enterprise Manager Unspecified Cross Site Scripting Vulnerability

Bugtraq ID:	47642
Class:	Input Validation Error
CVE:	CVE-2011-1423
Remote:	Yes
Local:	No
Published:	Apr 29 2011 12:00AM
Updated:	Apr 29 2011 12:00AM
Credit:	National Australia Bank's Security Assurance team
Vulnerable:	RSA Security Data Loss Prevention (DLP) Enterprise Manager 8.5 RSA Security Data Loss Prevention (DLP) Enterprise Manager 8.0
Not Vulnerable:	RSA Security Data Loss Prevention (DLP) Enterprise Manager 8.5 SP1

RSA Data Loss Prevention (DLP) Enterprise Manager Unspecified Cross Site Scripting Vulnerability

RSA Data Loss Prevention (DLP) Enterprise Manager is prone to a cross-site scripting vulnerability because it fails to properly sanitize unspecified user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

RSA Data Loss Prevention (DLP) Enterprise Manager Unspecified Cross Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

RSA Data Loss Prevention (DLP) Enterprise Manager Unspecified Cross Site Scripting Vulnerability

Solution:
Updates are available; please see the references for more information.

RSA Data Loss Prevention (DLP) Enterprise Manager Unspecified Cross Site Scripting Vulnerability

References:

• RSA Data Loss Prevention Homepage (RSA)
  
• RSA Homepage (RSA Security)
  
• ESA-2011-015: RSA, The Security Division of EMC, announces a fix for a security ()