Full Disclosure mailing list archives
[CVE-2012-1990] Kerweb/Kerwin XSS vulnerabilities
From: phocean <0x90 () phocean net>
Date: Sat, 5 May 2012 18:26:43 +0200
Kerweb/Kerwin XSS vulnerabilities Severity: Moderate Vendor: Schneider Electrics Versions Affected: Kerweb < 3.0.1 Kerwin < 6.0.1 Description: Input fields used for searching and displaying content are not filtered properly. Thus, the web application suffers from multiple reflected XSS vulnerabilities. Exploitation is made easier as parameters are passed with GET HTTP method. Example: An URL can be forged by injecting code in one of the parameter, like 'evtvariablename' here: http://<server>/kw.dll?page=evts.xml&sessionid=xxx&nomenu=&typeevtwin=alms&dt=>variablevalue=<variablevalue=&variablevalue=&nevariablevalue=&evtclass=&evtdevicezone=&evtdevicecountry=&evtdeviceregion=&evtstatustype=&evtseveritytype=&evtstatus=&evtseverity=&evtlevel=>dateapp=<dateapp=>daterec=<daterec=&evtvariablename="</script><script>alert(1)</script>"&evtdevicename=&evtnature=&evttype=>duration=<duration=>durationvalue=>durationwide=1<durationvalue=<durationwide=1 Vendor status: Vendor was contacted and a fix was released (with Kerweb 3.0.1 and Kerwin 6.0.1) Mitigation: Upgrade to Kerweb 3.0.1 and Kerwin 6.0.1 CVE: CVE-2012-1990 Timeline: 06/20/2011: vendor disclosure (ticket reference : KN10915) 07/22/2011: vendor response 09/01/2012: fix released 05/05/2012: public disclosure --- phocean
Attachment:
signature.asc
Description: Message signed with OpenPGP using GPGMail
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- [CVE-2012-1990] Kerweb/Kerwin XSS vulnerabilities phocean (May 05)