Adobe RoboHelp CVE-2012-0765 Cross Site Scripting Vulnerability

Bugtraq ID:	52008
Class:	Input Validation Error
CVE:	CVE-2012-0765
Remote:	Yes
Local:	No
Published:	Feb 14 2012 12:00AM
Updated:	Feb 14 2012 12:00AM
Credit:	David Damstra
Vulnerable:	Adobe RoboHelp 9 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home Adobe RoboHelp 8 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT Workstation 4.0 SP6a - Microsoft Windows NT Workstation 4.0 SP5 - Microsoft Windows NT Workstation 4.0 SP4 - Microsoft Windows NT Workstation 4.0 SP3 - Microsoft Windows NT Workstation 4.0 SP2 - Microsoft Windows NT Workstation 4.0 SP1 - Microsoft Windows NT Workstation 4.0 - Microsoft Windows XP Home
Not Vulnerable:

Adobe RoboHelp CVE-2012-0765 Cross Site Scripting Vulnerability

Adobe RoboHelp is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker could exploit this vulnerability to execute arbitrary script code in the context of the affected website. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Adobe RoboHelp 8 and 9 are vulnerable.

Adobe RoboHelp CVE-2012-0765 Cross Site Scripting Vulnerability

To exploit this issue, an attacker must entice a victim into following a malicious URI.

Adobe RoboHelp CVE-2012-0765 Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references for details.

Adobe RoboHelp CVE-2012-0765 Cross Site Scripting Vulnerability

References:

• Robohelp Web Site (Adobe)
  
• Security update available for RoboHelp for Word (Adobe)