Symantec Encryption Management Server Web Email Protection Cross Site Scripting Vulnerability

Bugtraq ID:	61290
Class:	Input Validation Error
CVE:	CVE-2013-4674
Remote:	Yes
Local:	No
Published:	Jul 22 2013 12:00AM
Updated:	Jul 22 2013 12:00AM
Credit:	John Carroll - tghc.co - @n0x00
Vulnerable:
Not Vulnerable:

Symantec Encryption Management Server Web Email Protection Cross Site Scripting Vulnerability

Encryption Management Server is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Symantec Encryption Management Server Web Email Protection Cross Site Scripting Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to view a malicious email attachment.

Symantec Encryption Management Server Web Email Protection Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Symantec Encryption Management Server Web Email Protection Cross Site Scripting Vulnerability

References:

• PGP Universal Server Homepage (Symantec)
  
• Symantec Home Page (Symantec)
  
• SYM13-007 - Symantec Encryption Management Server Web Email Protection XSS (Symantec)