XEROX DocuShare URL XSS Injection Vulnerabilities

2008.05.30
Credit: DoZ
Risk: Low
Local: No
Remote: No
CVE: CVE-2008-5225
CWE: CWE-79
Dork: DocuShare Login


Ogólna skala CVSS: 4.3/10
Znaczenie: 2.9/10
Łatwość wykorzystania: 8.6/10
Wymagany dostęp: Zdalny
Złożoność ataku: Średnia
Autoryzacja: Nie wymagana
Wpływ na poufność: Brak
Wpływ na integralność: Częściowy
Wpływ na dostępność: Brak

XEROX DocuShare URL XSS Injection Vulnerabilities Xerox DocuShare is a flexible Web-based content management solution that brings greater productivity to every knowledge worker. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. Hackers Center Security Group (http://www.hackerscenter.com) Credit: Doz Class: Cross Site Scripting Remote: Yes Product: DocuShare Vendor: http://docushare.xerox.com/ Version: 6 & Previous Attackers can exploit these issues via a web client. http://docushare.site.com/dsdn/dsweb/SearchResults/XSS http://docushare.site.com/dsdn/dsweb/Services/User-XSS http://docushare.site.com/docushare/dsweb/ServicesLib/Group-#/XSS Google Dork: DocuShare Login

Referencje:

https://docushare.xerox.com/doug/dsweb/Get/Document-20353/SA30426-workaround.html
http://www.securityfocus.com/bid/29430
http://www.securityfocus.com/archive/1/archive/1/492766/100/0/threaded
http://www.frsirt.com/english/advisories/2008/1701/references
http://secunia.com/advisories/30426


See this note in RAW Version
Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}
Copyright 2024, cxsecurity.com

 

Back to Top