###############################################################
ID: S21SEC-023-en
Title: Multiple Cross Site Scripting vulnerabilities in Vignette
Date: 03/04/2003
Status: Vendor contacted and solution available
Scope: HTML code Execution in client browsers
Platforms: All
Author: rpinuaga
Location: http://www.s21sec.com/es/avisos/s21sec-023-en.txt
Release: External
###############################################################
S 2 1 S E C
http://www.s21sec.com
Multiple Cross Site Scripting vulnerabilities in Vignette
About Vignette
--------------
Vignette develops Content Management and Application Portal Software.
Description of vulnerability
----------------------------
Vignette Software presents multiple Cross Site Scripting vulnerabilities. (XSS)
It's possible to inyect HTML code in text variables. This variables when are showed by a Vignette Application, can execute arbitrary code in the client browser.
Vignette don't offer any protection against this kind of attacks.
Vignette does not filter any of the "forbidden" HTML chars (<,>,",&)
This vulnerability affects all vignette applications that show input user variables without an explicit filter. Even the default error template is vulnerable.
Affected Versions and platforms
-------------------------------
This vulnerability has been tested in Vignette StoryServer 4 to Vignette V/6. But it seems that all currently avaliable versions are vulnerable.
Solution
--------
Vignette users should procceed to contact vignette throught the standard channels VOLS etc in order to get a solution.
Additional information
----------------------
These vulnerabilities have been found and researched by:
Ramon Pinuaga Cascales rpinuaga (at) s21sec (dot) com [email concealed]
You can find the last version of this warning in:
http://www.s21sec.com/es/avisos/s21sec-023-en.txt
And other S21SEC warnings in http://www.s21sec.com/es/avisos/
ID: S21SEC-023-en
Title: Multiple Cross Site Scripting vulnerabilities in Vignette
Date: 03/04/2003
Status: Vendor contacted and solution available
Scope: HTML code Execution in client browsers
Platforms: All
Author: rpinuaga
Location: http://www.s21sec.com/es/avisos/s21sec-023-en.txt
Release: External
###############################################################
S 2 1 S E C
http://www.s21sec.com
Multiple Cross Site Scripting vulnerabilities in Vignette
About Vignette
--------------
Vignette develops Content Management and Application Portal Software.
Description of vulnerability
----------------------------
Vignette Software presents multiple Cross Site Scripting vulnerabilities. (XSS)
It's possible to inyect HTML code in text variables. This variables when are showed by a Vignette Application, can execute arbitrary code in the client browser.
Vignette don't offer any protection against this kind of attacks.
For example this way:
https://www.somesite.es/Page/1,10966,,00.html?var=<script>alert('s21sec'
)</script>
Even some default templates are vulnerable to this type of injection:
http://www.somestie.es/vgn/login?errInfo="%2b%20document.cookie%20%2b"
Vignette does not filter any of the "forbidden" HTML chars (<,>,",&)
This vulnerability affects all vignette applications that show input user variables without an explicit filter. Even the default error template is vulnerable.
Affected Versions and platforms
-------------------------------
This vulnerability has been tested in Vignette StoryServer 4 to Vignette V/6. But it seems that all currently avaliable versions are vulnerable.
Solution
--------
Vignette users should procceed to contact vignette throught the standard channels VOLS etc in order to get a solution.
Additional information
----------------------
These vulnerabilities have been found and researched by:
Ramon Pinuaga Cascales rpinuaga (at) s21sec (dot) com [email concealed]
You can find the last version of this warning in:
http://www.s21sec.com/es/avisos/s21sec-023-en.txt
And other S21SEC warnings in http://www.s21sec.com/es/avisos/
[ reply ]