LiveZilla CVE-2013-7032 Multiple HTML Injection Vulnerabilities

Bugtraq ID:	64376
Class:	Input Validation Error
CVE:	CVE-2013-7032
Remote:	Yes
Local:	No
Published:	Dec 15 2013 12:00AM
Updated:	Dec 15 2013 12:00AM
Credit:	Jakub Zoczek
Vulnerable:	LiveZilla LiveZilla 5.1.2.0
Not Vulnerable:	LiveZilla LiveZilla 5.1.2.1

LiveZilla CVE-2013-7032 Multiple HTML Injection Vulnerabilities

LiveZilla is prone to multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

LiveZilla 5.1.2.0 is vulnerable; other versions may also be affected.

LiveZilla CVE-2013-7032 Multiple HTML Injection Vulnerabilities

An attacker can exploit these issues using a web browser.

LiveZilla CVE-2013-7032 Multiple HTML Injection Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

LiveZilla CVE-2013-7032 Multiple HTML Injection Vulnerabilities

References:

• LiveZilla 5.1.2.0 Multiple Stored XSS in webbased operator client (Seclists)
  
• LiveZilla Changelog (LiveZilla)
  
• LiveZilla Homepage (LiveZilla)