IBM Lotus Notes Traveler Open-Redirection and Cross Site Scripting Vulnerabilities
BID:55801
Info
IBM Lotus Notes Traveler Open-Redirection and Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 55801 |
| Class: | Input Validation Error |
| CVE: |
CVE-2012-4824 CVE-2012-4825 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 05 2012 12:00AM |
| Updated: | Oct 05 2012 12:00AM |
| Credit: | Eugene Dokukin |
| Vulnerable: |
IBM Lotus Notes Traveler 8.5.3 2 IBM Lotus Notes Traveler 8.5.3 1 IBM Lotus Notes Traveler 8.5.1.3 IBM Lotus Notes Traveler 8.5.1.2 IBM Lotus Notes Traveler 8.5.1.1 IBM Lotus Notes Traveler 8.5.1.0 IBM Lotus Notes Traveler 8.5.0.2 IBM Lotus Notes Traveler 8.5.0.1 |
| Not Vulnerable: | |
Discussion
IBM Lotus Notes Traveler Open-Redirection and Cross Site Scripting Vulnerabilities
IBM Lotus Notes Traveler is prone to an open-redirection and cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
Attackers can exploit these issues to execute arbitrary script or HTML code, steal cookie-based authentication credentials, and conduct phishing attacks. Other attacks may also be possible.
Versions prior to IBM Lotus Notes Traveler 8.5.3 Fix Pack 2 are vulnerable.
IBM Lotus Notes Traveler is prone to an open-redirection and cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
Attackers can exploit these issues to execute arbitrary script or HTML code, steal cookie-based authentication credentials, and conduct phishing attacks. Other attacks may also be possible.
Versions prior to IBM Lotus Notes Traveler 8.5.3 Fix Pack 2 are vulnerable.
Exploit / POC
IBM Lotus Notes Traveler Open-Redirection and Cross Site Scripting Vulnerabilities
An attacker can exploit these issues by enticing an unsuspecting victim into following a malicious URI.
An attacker can exploit these issues by enticing an unsuspecting victim into following a malicious URI.
Solution / Fix
IBM Lotus Notes Traveler Open-Redirection and Cross Site Scripting Vulnerabilities
Solution:
Updates are available. Please see the references for more information.
Solution:
Updates are available. Please see the references for more information.
References
IBM Lotus Notes Traveler Open-Redirection and Cross Site Scripting Vulnerabilities
References:
References:
- IBM Homepage (IBM)