Microsoft Dynamic AX Enterprise Portal Cross Site Scripting Vulnerability

Bugtraq ID:	53863
Class:	Input Validation Error
CVE:	CVE-2012-1857
Remote:	Yes
Local:	No
Published:	Jun 12 2012 12:00AM
Updated:	Jun 12 2012 12:00AM
Credit:	Finian Mackin
Vulnerable:	Microsoft Dynamics AX 2012 Enterprise Portal 0
Not Vulnerable:

Microsoft Dynamic AX Enterprise Portal Cross Site Scripting Vulnerability

Microsoft Dynamic AX is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to perform unauthorized actions such as reading, modifying, or deleting content on the Dynamics AX Enterprise Portal site on behalf of the victim.

Microsoft Dynamic AX Enterprise Portal Cross Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.

Microsoft Dynamic AX Enterprise Portal Cross Site Scripting Vulnerability

Solution:
Vendor updates are available. Please see the references for more information.


Microsoft Dynamics AX 2012 Enterprise Portal 0

• Microsoft Vulnerability in Microsoft Dynamics AX Enterprise Portal Could Allow Elevation of Privilege (KB27067
  http://www.microsoft.com/downloads/details.aspx?familyid=45df362d-8fed -4d99-91c1-81c61878300a


• Microsoft Vulnerability in Microsoft Dynamics AX Enterprise Portal Could Allow Elevation of Privilege (KB27106
  http://www.microsoft.com/downloads/details.aspx?familyid=780ddcef-19da -44c4-beca-d10b652cd22a


• Microsoft Vulnerability in Microsoft Dynamics AX Enterprise Portal Could Allow Elevation of Privilege (KB27112
  http://www.microsoft.com/downloads/details.aspx?familyid=41dc5958-c224 -40f9-89c2-179607a8ee2a

Microsoft Dynamic AX Enterprise Portal Cross Site Scripting Vulnerability

References:

• Microsoft Homepage (Microsoft)
  
• Microsoft Security Bulletin MS12-040 (Microsoft)