SurfControl SuperScout Email Filter MsgError.ASP Cross-Site Scripting Vulnerability
SurfControl SuperScout Email Filter comes with a web-based interface to provide remote access to administrative facilities.
The web-based admin interface is prone to cross-site scripting attacks.
It is possible to create a link containing malicious HTML and script code to certain pages in the interface. When this link is visited by a web user, the attacker-supplied script code will execute in user's web client in the security context of the web interface.
This may potentially be exploited to steal cookie-based authentication credentials from legitimate users of the interface.