Websense TRITON AP-DATA CVE-2015-2764 Multiple HTML Injection Vulnerabilities

Bugtraq ID:	73424
Class:	Input Validation Error
CVE:	CVE-2015-2764
Remote:	Yes
Local:	No
Published:	Mar 27 2015 12:00AM
Updated:	Mar 27 2015 12:00AM
Credit:	Websense
Vulnerable:	Websense TRITON AP-DATA 7.8.3
Not Vulnerable:	Websense TRITON AP-DATA 8.0

Websense TRITON AP-DATA CVE-2015-2764 Multiple HTML Injection Vulnerabilities

Websense TRITON AP-DATA is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input.

Attacker supplied HTML and script code could be executed in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user; other attacks are also possible.

Websense TRITON AP-DATA CVE-2015-2764 Multiple HTML Injection Vulnerabilities

An attacker can exploit these issues using a web browser.

Websense TRITON AP-DATA CVE-2015-2764 Multiple HTML Injection Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Websense TRITON AP-DATA CVE-2015-2764 Multiple HTML Injection Vulnerabilities

References:

• Vulnerabilities resolved in TRITON APX Version 8.0 (Websense)
  
• Websense TRITON AP-DATA - Homepage (Websense)