Deerfield VisNetic WebSite Cross Site Scripting Vulnerability
BID:6369
Info
Deerfield VisNetic WebSite Cross Site Scripting Vulnerability
| Bugtraq ID: | 6369 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 12 2002 12:00AM |
| Updated: | Dec 12 2002 12:00AM |
| Credit: | Discovery of this vulnerability is credited to Ory Segal. |
| Vulnerable: |
Deerfield VisNetic Website 3.5.13 .1 |
| Not Vulnerable: |
Deerfield VisNetic Website 3.5.15 |
Discussion
Deerfield VisNetic WebSite Cross Site Scripting Vulnerability
A vulnerability has been discovered in VisNetic Website when generating a 404 page for a non-existent resources. The issue is due to insufficient sanitization of the HTTP 'referer' header. It is possible to cause arbitrary code to be executed within the context of the visited 404 page by embedding script code into the HTTP 'referer' header.
An attacker could exploit this issue to steal cookie-based authentication credentials which could be used to hijack a legitimate users session.
It should be noted that this vulnerability was discovered in VisNetic WebSite 3.5.13.1. It is not yet known whether this issue also affects earlier versions.
A vulnerability has been discovered in VisNetic Website when generating a 404 page for a non-existent resources. The issue is due to insufficient sanitization of the HTTP 'referer' header. It is possible to cause arbitrary code to be executed within the context of the visited 404 page by embedding script code into the HTTP 'referer' header.
An attacker could exploit this issue to steal cookie-based authentication credentials which could be used to hijack a legitimate users session.
It should be noted that this vulnerability was discovered in VisNetic WebSite 3.5.13.1. It is not yet known whether this issue also affects earlier versions.