Google Web Toolkit CVE-2013-4204 Multiple Cross Site Scripting Vulnerabilities

Bugtraq ID:	61590
Class:	Input Validation Error
CVE:	CVE-2013-4204
Remote:	Yes
Local:	No
Published:	Aug 04 2013 12:00AM
Updated:	Aug 22 2017 02:12PM
Credit:	David Jorm
Vulnerable:	Schneider-Electric Trio TView Software 3.27.0 Google Web Toolkit 2.5
Not Vulnerable:	Schneider-Electric Trio TView Software 3.29.0 Google Web Toolkit 2.5.1

Google Web Toolkit CVE-2013-4204 Multiple Cross Site Scripting Vulnerabilities

The Google Web Toolkit is prone to multiple cross-site scripting vulnerabilities because it fails to sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Google Web Toolkit 2.5.0 is vulnerable; other versions may also be affected.

Google Web Toolkit CVE-2013-4204 Multiple Cross Site Scripting Vulnerabilities

An attacker can exploit these issues by enticing an unsuspecting user to visit a specially crafted URL.

Google Web Toolkit CVE-2013-4204 Multiple Cross Site Scripting Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Google Web Toolkit CVE-2013-4204 Multiple Cross Site Scripting Vulnerabilities

References:

• Avoid XSS vulnerability by being stricter about how the script element is create (Google)
  
• Google Web Toolkit Homepage (Google)
  
• Re: CVE request: XSS in Google Web Toolkit (GWT) (David Jorm)
  
• Release Notes for 2.5.1 (Google)
  
• Advisory (ICSA-17-213-02) Schneider Electric Trio TView (CERT)