Mango Automation 'data_point_details.shtm' Multiple Cross Site Scripting Vulnerabilities

Bugtraq ID:	72780
Class:	Input Validation Error
CVE:	CVE-2015-1179
Remote:	Yes
Local:	No
Published:	Jan 22 2015 12:00AM
Updated:	Jan 22 2015 12:00AM
Credit:	Sudhanshu Chauhan
Vulnerable:	Infinite Automation Systems Mango Automation 2.4.0
Not Vulnerable:

Mango Automation 'data_point_details.shtm' Multiple Cross Site Scripting Vulnerabilities

Mango Automation is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Mango Automation 2.4.0 is vulnerable; other versions may also be affected.

Mango Automation 'data_point_details.shtm' Multiple Cross Site Scripting Vulnerabilities

Solution:
Reportedly the issue is fixed, however Symantec has not confirmed this. Please contact the vendor for more information.

Mango Automation 'data_point_details.shtm' Multiple Cross Site Scripting Vulnerabilities

References:

• CVE-2015-1179-xss-mango-automation-scada (Octogence)
  
• Mango Automation Homepage (Infinite Automation Systems)