Barracuda Message Archiver 650 HTML Injection Vulnerability

Bugtraq ID:	50596
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 08 2011 12:00AM
Updated:	Nov 08 2011 12:00AM
Credit:	Anonymous
Vulnerable:	Barracuda Networks Message Archiver 650 2.2.1
Not Vulnerable:	Barracuda Networks Message Archiver 650 2.2.1.001

Barracuda Message Archiver 650 HTML Injection Vulnerability

The Barracuda Message Archiver 650 is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input.

Attacker-supplied HTML and script code would execute in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

Barracuda Message Archiver 650 versions prior to 2.2.1.001 are vulnerable.

Barracuda Message Archiver 650 HTML Injection Vulnerability

Attackers can use browser to exploit this issue.

Barracuda Message Archiver 650 HTML Injection Vulnerability

Solution:
Vendor updates are available. Please see the references for more information.

Barracuda Message Archiver 650 HTML Injection Vulnerability

References:

• Barracuda Archiver 650 - Input Validation Vulnerability (Vulnerability Research Laboratory)
  
• Barracuda Message Archiver 650 Homepage (Barracuda)