Cross-Site Scripting Vulnerability in Astaro Security Linux

vendor:

Astaro Security Linux

by:

Unknown

5.5

CVSS

MEDIUM

Cross-Site Scripting

CWE

Product Name: Astaro Security Linux

Affected Version From: Astaro Security Linux 5

Affected Version To: Unknown

Patch Exists: NO

Related CWE: Unknown

CPE: a:astaro_security_gateway:astaro_security_linux:5

Metasploit:

Other Scripts:

Platforms Tested:

Unknown

Cross-Site Scripting Vulnerability in Astaro Security Linux

Astaro Security Linux is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Mitigation:

To mitigate this vulnerability, it is recommended to sanitize user-supplied input before using it in dynamically generated web pages.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/38893/info

Astaro Security Linux is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

The issue affects Astaro Security Linux 5; other versions may also be affected. 

The following example POST data is available:

username=my@example.com&password=DTC&SID=>"><script>alert("XSS !!!")</script>&cur_width=1&window_height=700&id=0121&jaction=none&frameset=active&new_id=0