AxisInternet VoIP Manager Multiple Cross Site Scripting Vulnerabilities

Bugtraq ID:	55589
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 18 2012 12:00AM
Updated:	Sep 18 2012 12:00AM
Credit:	Benjamin Kunz Mejri
Vulnerable:
Not Vulnerable:

AxisInternet VoIP Manager Multiple Cross Site Scripting Vulnerabilities

AxisInternet VoIP Manager is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

AxisInternet VoIP Manager 2.1.5.7 is vulnerable; other versions may also be affected.

AxisInternet VoIP Manager Multiple Cross Site Scripting Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

AxisInternet VoIP Manager Multiple Cross Site Scripting Vulnerabilities

References:

• Axis VoIP Manager v2.1.5.7 - Multiple Web Vulnerabilities (Vulnerability Lab)
  
• AxisInternet VoIP Manager HomePage (AxisInternet, Inc.)