Red Hat Certificate System CVE-2013-1885 Multiple Cross Site Scripting Vulnerabilities

Bugtraq ID:	60084
Class:	Input Validation Error
CVE:	CVE-2013-1885
Remote:	Yes
Local:	No
Published:	May 22 2013 12:00AM
Updated:	Apr 16 2015 05:46PM
Credit:	Red Hat
Vulnerable:
Not Vulnerable:

Red Hat Certificate System CVE-2013-1885 Multiple Cross Site Scripting Vulnerabilities

Red Hat Certificate System is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary HTML and script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Red Hat Certificate System CVE-2013-1885 Multiple Cross Site Scripting Vulnerabilities

Attackers can exploit these issues by enticing an unsuspecting victim into following a malicious URI.

Red Hat Certificate System CVE-2013-1885 Multiple Cross Site Scripting Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Red Hat Certificate System CVE-2013-1885 Multiple Cross Site Scripting Vulnerabilities

References:

• Bug 923039 - (CVE-2013-1885) CVE-2013-1885 Certificate System: pki-tps XSS flaw (Red Hat)
  
• Dogtag Certificate System Homepage (Red Hat)
  
• Red Hat Certificate System Homepage (Red Hat)