BugTraq
Websense Email Security vulnerable to persistent Cross-Site Scripting in audit log details view Mar 18 2015 05:20PM
Securify B.V. (lists securify nl)
------------------------------------------------------------------------

Websense Email Security vulnerable to persistent Cross-Site Scripting in
audit log details view
------------------------------------------------------------------------

Han Sahin, September 2014

------------------------------------------------------------------------

Abstract
------------------------------------------------------------------------

Users of Websense Data Security that are reviewing DLP incidents can be
attacked via Cross-Site Scripting. This issue can be exploited using a
specially crafted email, or by sending a specially crafted HTTP request
through the Websense proxy. The attacker-supplied code can perform a
wide variety of attacks, such as stealing session tokens, login
credentials, performing arbitrary actions as victims, or logging
victims' keystrokes.

------------------------------------------------------------------------

Tested versions
------------------------------------------------------------------------

This issue was discovered on Websense Triton v7.8.3 and Websense
appliance modules V-Series v7.7. Other versions may be affected as well.

------------------------------------------------------------------------

Fix
------------------------------------------------------------------------

This issue is resolved in TRITON APX Version 8.0. More information about
the fixed can be found at the following location:
http://www.websense.com/support/article/kbarticle/Vulnerabilities-resolv
ed-in-TRITON-APX-Version-8-0

------------------------------------------------------------------------

Details
------------------------------------------------------------------------

https://www.securify.nl/advisory/SFY20140905/websense_email_security_vul
nerable_to_persistent_cross_site_scripting_in_audit_log_details_view.htm
l

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus