SurfControl SuperScout Email Filter Cross-Site Scripting Vulnerability

vendor:

SuperScout Email Filter

by:

SecurityFocus

7.5

CVSS

HIGH

Cross-Site Scripting

CWE

Product Name: SuperScout Email Filter

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2002

SurfControl SuperScout Email Filter Cross-Site Scripting Vulnerability

SurfControl SuperScout Email Filter comes with a web-based interface to provide remote access to administrative facilities. The web-based admin interface is prone to cross-site scripting attacks. It is possible to create a link containing malicious HTML and script code to certain pages in the interface. When this link is visited by a web user, the attacker-supplied script code will execute in user's web client in the security context of the web interface. This may potentially be exploited to steal cookie-based authentication credentials from legitimate users of the interface.

Mitigation:

Ensure that user-supplied input is properly sanitized and validated before being used in the web interface.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/5928/info

SurfControl SuperScout Email Filter comes with a web-based interface to provide remote access to administrative facilities.

The web-based admin interface is prone to cross-site scripting attacks.

It is possible to create a link containing malicious HTML and script code to certain pages in the interface. When this link is visited by a web user, the attacker-supplied script code will execute in user's web client in the security context of the web interface.

This may potentially be exploited to steal cookie-based authentication credentials from legitimate users of the interface.

http://www.example.com/web/msgError.asp?Redirect=loginhtm&Reason=<script>alert(document.cookie);</script>