Multiple Hitachi Products Cross Site Scripting and Cross Site Request Forgery Vulnerabilities
BID:68015
Info
Multiple Hitachi Products Cross Site Scripting and Cross Site Request Forgery Vulnerabilities
| Bugtraq ID: | 68015 |
| Class: | Input Validation Error |
| CVE: |
CVE-2014-4188 CVE-2014-4189 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 10 2014 12:00AM |
| Updated: | Aug 06 2014 12:31AM |
| Credit: | The vendor reported this issue. |
| Vulnerable: |
Hitachi Tuning Manager Software 7.0 01 (Windows) Hitachi Tuning Manager Software 7.0 (Windows) Hitachi Tuning Manager Software 6.4 02 (Windows) Hitachi Tuning Manager Software 6.4 01 (Windows) Hitachi Tuning Manager Software 6.2 -01 (Windows) Hitachi Tuning Manager Software 6.2 -00 (Windows) Hitachi Tuning Manager Software 6.1 -00 (Windows) Hitachi Tuning Manager Software 6.0 (Windows) Hitachi Tuning Manager Software 7.1.0-00 (Windows) Hitachi Tuning Manager Software 6.4.0-03 (Windows) |
| Not Vulnerable: | |
Discussion
Multiple Hitachi Products Cross Site Scripting and Cross Site Request Forgery Vulnerabilities
Multiple Hitachi products are prone to a cross-site scripting vulnerability and a cross-site request-forgery vulnerability because it fails to sanitize user-supplied input.
An attacker can exploit these vulnerabilities to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, disclose or modify sensitive information, or perform unauthorized actions. Other attacks are also possible.
The following are vulnerable:
Hitachi Tuning Manager Software
Hitachi JP1/Performance Management - Manager Web Option
Multiple Hitachi products are prone to a cross-site scripting vulnerability and a cross-site request-forgery vulnerability because it fails to sanitize user-supplied input.
An attacker can exploit these vulnerabilities to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, disclose or modify sensitive information, or perform unauthorized actions. Other attacks are also possible.
The following are vulnerable:
Hitachi Tuning Manager Software
Hitachi JP1/Performance Management - Manager Web Option
Exploit / POC
Multiple Hitachi Products Cross Site Scripting and Cross Site Request Forgery Vulnerabilities
An attacker can exploit these issues by enticing an unsuspecting user to visit a specially crafted URL.
An attacker can exploit these issues by enticing an unsuspecting user to visit a specially crafted URL.
Solution / Fix
Multiple Hitachi Products Cross Site Scripting and Cross Site Request Forgery Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Multiple Hitachi Products Cross Site Scripting and Cross Site Request Forgery Vulnerabilities
References:
References:
- Hitachi Tuning Manager Homepage (Hitachi)