RSA Archer GRC CVE-2014-4633 Unspecified HTML Injection Vulnerability

Bugtraq ID:	71660
Class:	Input Validation Error
CVE:	CVE-2014-4633
Remote:	Yes
Local:	No
Published:	Dec 12 2014 12:00AM
Updated:	Dec 12 2014 12:00AM
Credit:	EMC
Vulnerable:
Not Vulnerable:

RSA Archer GRC CVE-2014-4633 Unspecified HTML Injection Vulnerability

RSA Archer GRC is prone to an unspecified HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.

RSA Archer GRC 5.x versions are vulnerable.

RSA Archer GRC CVE-2014-4633 Unspecified HTML Injection Vulnerability

Attackers can exploit this issue using browser.

RSA Archer GRC CVE-2014-4633 Unspecified HTML Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

RSA Archer GRC CVE-2014-4633 Unspecified HTML Injection Vulnerability

References:

• EMC RSA Archer GRC HomePage (EMC)
  
• ESA-2014-163: RSA Archer GRC Platform Multiple Vulnerabilities (EMC)