LogAnalyzer CVE-2012-3790 Cross-Site Scripting Vulnerability

Bugtraq ID:	73862
Class:	Input Validation Error
CVE:	CVE-2012-3790
Remote:	Yes
Local:	No
Published:	Jun 20 2012 12:00AM
Updated:	Jun 20 2012 12:00AM
Credit:	Unknown
Vulnerable:	Adiscon LogAnalyzer 3.5.4 Adiscon LogAnalyzer 3.5.3 Adiscon LogAnalyzer 3.5.2 Adiscon LogAnalyzer 3.5.1 Adiscon LogAnalyzer 3.5.0 Adiscon LogAnalyzer 3.4.3 Adiscon LogAnalyzer 3.4.2 Adiscon LogAnalyzer 3.4.1 Adiscon LogAnalyzer 3.4.0 Adiscon LogAnalyzer 3.3.0 Adiscon LogAnalyzer 3.2.3 Adiscon LogAnalyzer 3.2.2 Adiscon LogAnalyzer 3.2.1 Adiscon LogAnalyzer 3.2.0
Not Vulnerable:

LogAnalyzer CVE-2012-3790 Cross-Site Scripting Vulnerability

LogAnalyzer is prone to a cross-site scripting vulnerability. Cross-site scripting (XSS) vulnerability in index.php in Adiscon LogAnalyzer before 3.4.4 and 3.5.x before 3.5.5 allows remote attackers to inject arbitrary web script or HTML via the highlight parameter in a Search action.

LogAnalyzer CVE-2012-3790 Cross-Site Scripting Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or you are aware of more recent information, please mail us at: [email protected]

LogAnalyzer CVE-2012-3790 Cross-Site Scripting Vulnerability

References:

• http://loganalyzer.adiscon.com/security-advisories/loganalyzer-cross-site-script (MISC)
  
• http://secpod.org/advisories/SecPod_LogAnalyzer_XSS_Vuln.txt (MISC)
  
• http://secpod.org/blog/?p=504 (MISC)
  
• LogAnalyzer 3.4.4 (v3-stable) - Adiscon LogAnalyzer (CONFIRM)
  
• LogAnalyzer v3.5.5 (v3-beta) - Adiscon LogAnalyzer (CONFIRM)