Apache Flex 'asdoc/templates/index.html' Cross Site Scripting Vulnerability

Bugtraq ID:	73954
Class:	Input Validation Error
CVE:	CVE-2015-1773
Remote:	Yes
Local:	No
Published:	Apr 07 2015 12:00AM
Updated:	May 07 2015 05:37PM
Credit:	Radjnies Bhansingh
Vulnerable:	Apache Flex 0 Adobe Flex 4.6 Adobe Flex 4.5 Adobe Flex 4.4 Adobe Flex 4.3 Adobe Flex 4.2 Adobe Flex 4.1 Adobe Flex 4.0 Adobe Flex 3.0 Adobe Flex 2.0
Not Vulnerable:	Apache Flex 4.14.1

Apache Flex 'asdoc/templates/index.html' Cross Site Scripting Vulnerability

Apache Flex is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary HTML and script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Versions prior to Apache Flex 4.14.1 are vulnerable.

Apache Flex 'asdoc/templates/index.html' Cross Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting victim into following a malicious URI.

Apache Flex 'asdoc/templates/index.html' Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.