Vision HelpDesk User Spoofing and Cross Site Scripting Vulnerabilities

Bugtraq ID:	65661
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 14 2014 12:00AM
Updated:	Feb 14 2014 12:00AM
Credit:	Rack911
Vulnerable:	Vision HelpDesk Vision HelpDesk 3.8.7 Vision HelpDesk Vision HelpDesk 3.8.6 Vision HelpDesk Vision HelpDesk 3.8.4
Not Vulnerable:	Vision HelpDesk Vision HelpDesk 3.8.8

Vision HelpDesk User Spoofing and Cross Site Scripting Vulnerabilities

Vision HelpDesk is prone to a cross-site scripting vulnerability and multiple user spoofing vulnerabilities.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to spoof and impersonate a legitimate user; other attacks are also possible.

Versions prior to Vision HelpDesk 3.8.8 are vulnerable.

Vision HelpDesk User Spoofing and Cross Site Scripting Vulnerabilities

An attacker can exploit these issues by enticing an unsuspecting user to visit a specially crafted URL.

Vision HelpDesk User Spoofing and Cross Site Scripting Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Vision HelpDesk User Spoofing and Cross Site Scripting Vulnerabilities

References:

• Vision HelpDesk �?? Add Contact Input Validation Failure (R911-0126) (Rack911)
  
• Vision HelpDesk �?? Profile Input Validation Failure (R911-0127) (Rack911)
  
• Vision HelpDesk �?? XSS Admin Hijack (R911-0128) (Rack911)
  
• Vision HelpDesk Homepage (Vision Helpdesk)
  
• Vision Helpdesk V3.8.8 Security Update (Vision Helpdesk)