vendor:
Monarch Business Intelligence
by:
SecurityFocus
7,5
CVSS
HIGH
Multiple Input Validation Vulnerabilities
20
CWE
Product Name: Monarch Business Intelligence
Affected Version From: 5.1
Affected Version To: 5.1
Patch Exists: NO
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2012
DataWatch Monarch Business Intelligence Multiple Input Validation Vulnerabilities
DataWatch Monarch Business Intelligence is prone to multiple input validation vulnerabilities. Successful exploits will allow an attacker to manipulate the XPath query logic to carry out unauthorized actions on the XML documents of the application. It will also allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
Mitigation:
Input validation should be used to detect unauthorized input before it is processed by the application. Input validation should be applied on both client-side and server-side scripts. All input data should be filtered and validated before being passed to the XPath query logic.
