#########################################
Application: RSA EnVision
Vendor: http://www.rsa.com
Version: Version 3.3.6 Build 0115
Bug: Cross-Site Scripting
Risk: Medium
Date: 12 Sept 2007
Author: Stelios Tigkas
e-mail: Stigkas at Gmail dot com
Current Employer: Fujitsu Services
List: BugTraq(SecurityFocus)
#########################################
=======
Product
=======
A Security Event Management Solution.
===
Bug
===
There is a Reflected (Type I) Cross-Site Scripting hole on the
username field, in the logon page of the EnVision application. The
following attack vector has been confirmed by the Vendor to work:
</script><script>alert(document.cookie)</script>.
Application: RSA EnVision
Vendor: http://www.rsa.com
Version: Version 3.3.6 Build 0115
Bug: Cross-Site Scripting
Risk: Medium
Date: 12 Sept 2007
Author: Stelios Tigkas
e-mail: Stigkas at Gmail dot com
Current Employer: Fujitsu Services
List: BugTraq(SecurityFocus)
#########################################
=======
Product
=======
A Security Event Management Solution.
===
Bug
===
There is a Reflected (Type I) Cross-Site Scripting hole on the
username field, in the logon page of the EnVision application. The
following attack vector has been confirmed by the Vendor to work:
</script><script>alert(document.cookie)</script>.
RSA have been notified on 23.03.2007
[ reply ]