JBoss Enterprise Application Platform CVE-2011-4575 HTML Injection Vulnerability

Bugtraq ID:	57548
Class:	Input Validation Error
CVE:	CVE-2011-4575
Remote:	Yes
Local:	No
Published:	Dec 05 2011 12:00AM
Updated:	Dec 05 2011 12:00AM
Credit:	Tyler Krpata
Vulnerable:	Red Hat JBoss Enterprise Web Platform for RHEL 5 Server 5 Red Hat JBoss Enterprise Web Platform for RHEL 4ES 5 Red Hat JBoss Enterprise Web Platform for RHEL 4AS 5 Red Hat JBoss Enterprise Application Platform for RHEL 5 Server 5 Red Hat JBoss Enterprise Application Platform for RHEL 4ES 5 Red Hat JBoss Enterprise Application Platform for RHEL 4AS 5
Not Vulnerable:

JBoss Enterprise Application Platform CVE-2011-4575 HTML Injection Vulnerability

JBoss Enterprise Application Platform is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied data.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.

JBoss Enterprise Application Platform CVE-2011-4575 HTML Injection Vulnerability

Attackers can use a browser to exploit this issue.

JBoss Enterprise Application Platform CVE-2011-4575 HTML Injection Vulnerability

Solution:
Vendor updates are available. Please see the references for more information.

JBoss Enterprise Application Platform CVE-2011-4575 HTML Injection Vulnerability

References:

• JBoss Enterprise Application Platform Homepage (Red Hat)