HP Compaq Insight Manager Web Interface Cross-Site Scripting Vulnerability

Bugtraq ID:	5780
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 23 2002 12:00AM
Updated:	Sep 23 2002 12:00AM
Credit:	This issue was discovered during an automated scan and reported by Taylor Huff <[email protected]>.
Vulnerable:	Compaq Insight Management Agents 4.37 Compaq Insight Management Agents 4.2 Compaq Insight Management Agents 3.6 .0 Compaq Insight Management Agents 2.1 b Compaq Insight Management Agents 2.1 Compaq Insight Management Agents 2.0
Not Vulnerable:	Compaq Insight Management Agents 5.0 .0

HP Compaq Insight Manager Web Interface Cross-Site Scripting Vulnerability

It has been reported that the Compaq Insight Manager web interface is prone to cross-site scripting attacks. It is possible to construct a malicious link to a Compaq Insight Manager web interface that includes arbitrary script code. When the link is visited with a web client, the script code will execute in the context of the Compaq Insight Manager web interface.

The component which appears to be affected is Compaq Insight Management Agents. However, further details about which software is vulnerable are not available.

HP Compaq Insight Manager Web Interface Cross-Site Scripting Vulnerability

The following proof-of-concept example was provided:

http://<Server IP>:2301/<script>alert('Test')</script>

HP Compaq Insight Manager Web Interface Cross-Site Scripting Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

HP Compaq Insight Manager Web Interface Cross-Site Scripting Vulnerability

References: