RSA EnVision Reflected XSS Hole

["Stelios Tigkas" <stigkas () gmail com>]

#########################################
Application:           RSA EnVision
Vendor:                http://www.rsa.com
Version:                Version 3.3.6 Build 0115
Bug:                     Cross-Site Scripting
Risk:                     Medium
Date:                     12 Sept 2007
Author:                  Stelios Tigkas
e-mail:                   Stigkas at Gmail dot com
Current Employer:   Fujitsu Services
List:                       BugTraq(SecurityFocus)
#########################################


=======
Product
=======
A Security Event Management Solution.

===
Bug
===

There is a Reflected (Type I) Cross-Site Scripting hole on the
username field, in the logon page of the EnVision application. The
following attack vector has been confirmed by the Vendor to work:
</script><script>alert(document.cookie)</script>.

RSA have been notified on 23.03.2007