Accela BizSearch Unspecified Cross Site Scripting Vulnerability

Bugtraq ID:	62856
Class:	Input Validation Error
CVE:	CVE-2013-4711
Remote:	Yes
Local:	No
Published:	Oct 04 2013 12:00AM
Updated:	Oct 04 2013 12:00AM
Credit:	Yuji Tounai of bogus.jp
Vulnerable:	Accela Technology Corporation Accela BizSearch 3.2
Not Vulnerable:

Accela BizSearch Unspecified Cross Site Scripting Vulnerability

Accela BizSearch is prone to an unspecified cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Accela BizSearch 3.2 and prior versions are vulnerable.

Accela BizSearch Unspecified Cross Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.

Accela BizSearch Unspecified Cross Site Scripting Vulnerability

Solution:
Reportedly the issue is fixed, however Symantec has not confirmed this. Please contact the vendor for more information.

Accela BizSearch Unspecified Cross Site Scripting Vulnerability

References:

• Accela BizSearch HomePage (Accela Technology Corporation)
  
• JVNDB-2013-000094 Accela BizSearch vulnerable to cross-site scripting (IPA)
  
• JVN#33788325 Accela BizSearch vulnerable to cross-site scripting (JPCERT/CC and IPA)