HP XP P9000 Command View Advanced Edition CVE-2013-4814 Cross Site Scripting Vulnerability

Bugtraq ID:	62583
Class:	Input Validation Error
CVE:	CVE-2013-4814
Remote:	Yes
Local:	No
Published:	Sep 20 2013 12:00AM
Updated:	Sep 20 2013 12:00AM
Credit:	HP
Vulnerable:	HP XP P9000 Command View Advanced Edition 7.5.0-00 HP XP P9000 Command View Advanced Edition 7.4.1-00 HP XP P9000 Command View Advanced Edition 7.4.0-00 HP XP P9000 Command View Advanced Edition 7.3.1-00 HP XP P9000 Command View Advanced Edition 7.0.0-00
Not Vulnerable:	HP XP P9000 Command View Advanced Edition 7.5.0-02

HP XP P9000 Command View Advanced Edition CVE-2013-4814 Cross Site Scripting Vulnerability

HP XP P9000 Command View Advanced Edition is prone to an unspecified cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Versions prior to HP XP P9000 Command View Advanced Edition 7.5.0-02 are vulnerable.

HP XP P9000 Command View Advanced Edition CVE-2013-4814 Cross Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

HP XP P9000 Command View Advanced Edition CVE-2013-4814 Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

HP XP P9000 Command View Advanced Edition CVE-2013-4814 Cross Site Scripting Vulnerability

References:

• HP XP P9000 Command View Advanced Edition Homepage (HP)
  
• Micro News Homepage (phptoys)
  
• HP XP P9000 Command View Advanced Edition Suite Software XSS (HP)