Fujitsu Accela BizSearch Unspecified Cross Site Scripting Vulnerability

Bugtraq ID:	48497
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 29 2011 12:00AM
Updated:	Jun 29 2011 12:00AM
Credit:	Reported by the vendor
Vulnerable:	Fujitsu eAccela BizSearch 2.1 Fujitsu eAccela BizSearch 2.0 Fujitsu eAccela BizSearch 1.0 Fujitsu Accela BizSearch 3.1 Fujitsu Accela BizSearch 3.0
Not Vulnerable:

Fujitsu Accela BizSearch Unspecified Cross Site Scripting Vulnerability

Fujitsu Accela BizSearch is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

The following products are affected:

eAccela BizSearch 1.0
eAccela BizSearch 2.0
eAccela BizSearch 2.1
Accela BizSearch 3.0
Accela BizSearch 3.1

Fujitsu Accela BizSearch Unspecified Cross Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.

Fujitsu Accela BizSearch Unspecified Cross Site Scripting Vulnerability

Solution:
A vendor update is available. Please see the references for more information.

Fujitsu Accela BizSearch Unspecified Cross Site Scripting Vulnerability

References:

• Fujitsu Homepage (Fujitsu)
  
• JVNDB-2010-002807 Accela BizSearch Standard Search Page Cross-Site Scripting Vul (JVN iPedia)