IBM Lotus Sametime CVE-2012-3308 HTML Injection Vulnerability

Bugtraq ID:	54995
Class:	Input Validation Error
CVE:	CVE-2012-3308
Remote:	Yes
Local:	No
Published:	Aug 14 2012 12:00AM
Updated:	Aug 14 2012 12:00AM
Credit:	Reported by vendor.
Vulnerable:	IBM Lotus Sametime 8.5.1 IBM Lotus Sametime 8.0.2
Not Vulnerable:

IBM Lotus Sametime CVE-2012-3308 HTML Injection Vulnerability

IBM Lotus Sametime is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

IBM Lotus Sametime versions 8.0.2, 8.5.1, 8.5.1.1, 8.5.2, and 8.5.2.1 are vulnerable.

IBM Lotus Sametime CVE-2012-3308 HTML Injection Vulnerability

Attackers can use a browser to exploit this issue.

IBM Lotus Sametime CVE-2012-3308 HTML Injection Vulnerability

Solution:
Vendor updates are available. Please see the references for more details.

IBM Lotus Sametime CVE-2012-3308 HTML Injection Vulnerability

References:

• IBM Lotus Sametime Product Page (IBM)