Symantec Backup Exec CVE-2013-4676 Multiple Cross Site Scripting Vulnerabilities

Bugtraq ID:	61486
Class:	Input Validation Error
CVE:	CVE-2013-4676
Remote:	Yes
Local:	No
Published:	Aug 01 2013 12:00AM
Updated:	Oct 16 2013 12:54AM
Credit:	Perran Hill, Shaun Jones, Edward Torkington, Daniele Costa, and Andy Davis with NCC Group
Vulnerable:
Not Vulnerable:

Symantec Backup Exec CVE-2013-4676 Multiple Cross Site Scripting Vulnerabilities

Symantec Backup Exec is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Symantec Backup Exec CVE-2013-4676 Multiple Cross Site Scripting Vulnerabilities

To exploit these issues an attacker must entice an unsuspecting victim into following a malicious URI.

Symantec Backup Exec CVE-2013-4676 Multiple Cross Site Scripting Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Symantec Backup Exec CVE-2013-4676 Multiple Cross Site Scripting Vulnerabilities

References:

• Symantec Backup Exec Homepage (Symantec )