Neoteris Instant Virtual Extranet Cross Site Scripting Session Hijacking Vulnerability

Bugtraq ID:	7510
Class:	Input Validation Error
CVE:	CVE-2003-0217
Remote:	Yes
Local:	No
Published:	May 07 2003 12:00AM
Updated:	Jul 11 2009 09:07PM
Credit:	Discovery of this vulnerability has been credited to Dave Palumbo <[email protected]>.
Vulnerable:	Neoteris Instant Virtual Extranet 3.0.1
Not Vulnerable:	Neoteris Instant Virtual Extranet 3.1

Neoteris Instant Virtual Extranet Cross Site Scripting Session Hijacking Vulnerability

Neoteris Instant Virtual Extranet (IVE) has been reported prone to a cross-site scripting vulnerability.

The issue presents itself, due to a lack of sufficient sanitization performed on an argument passed to an IVE CGI script. An attacker may exploit this vulnerability to hijack valid Neoteris IVE sessions.

Neoteris Instant Virtual Extranet Cross Site Scripting Session Hijacking Vulnerability

There is no exploit required.

Neoteris Instant Virtual Extranet Cross Site Scripting Session Hijacking Vulnerability

Solution:
The vendor has released a patch to address this issue:


Neoteris Instant Virtual Extranet 3.0.1

• Neoteris Instant Virtual Extranet Patch For 3.01 And Prior
  https://support.neoteris.com

Neoteris Instant Virtual Extranet Cross Site Scripting Session Hijacking Vulnerability

References:

• Instant Virtual Extranet Homepage (Neoteris)