HP Service Manager and Service Center CVE-2012-3251 Unspecified Cross Site Scripting Vulnerability

Bugtraq ID:	55004
Class:	Input Validation Error
CVE:	CVE-2012-3251
Remote:	Yes
Local:	No
Published:	Aug 14 2012 12:00AM
Updated:	Aug 14 2012 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	HP Service Manager 9.21 HP Service Manager 7.11
Not Vulnerable:

HP Service Manager and Service Center CVE-2012-3251 Unspecified Cross Site Scripting Vulnerability

HP Service Manager and HP Service Center are prone to an unspecified cross-site scripting vulnerability.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected applications. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

The following versions are vulnerable:

HP Service Manager 7.11
HP Service Manager 9.21
HP Service Manager 9.30
HP Service Center 6.28

HP Service Manager and Service Center CVE-2012-3251 Unspecified Cross Site Scripting Vulnerability

To exploit this issue, an attacker must entice an unsuspecting victim to follow a malicious URI.

HP Service Manager and Service Center CVE-2012-3251 Unspecified Cross Site Scripting Vulnerability

Solution:
Vendor patch is available. Please see the references for more information.

HP Service Manager and Service Center CVE-2012-3251 Unspecified Cross Site Scripting Vulnerability

References:

• Micro News Homepage (phptoys)
  
• HPSBMU02803 SSRT100926 rev.1 - HP Service Manager and HP Service Center Web Tier (HP)