JVNDB-2008-000011

Internet Scanner reporting engine vulnerable to cross-site scripting

IBM Internet Scanner has a function to generate a report as an HTML file. Internet Scanner's reporting engine does not properly sanitize data before generating this report. This vulnerability may allow an attacker to insert an arbitrary script, which is executed on the user's web browser when the user views the output HTML file.

IBM Internet Scanner has a function to generate a report as an HTML file. Internet Scanner's reporting engine does not properly sanitize data before generating this report. This vulnerability may allow an attacker to insert an arbitrary script, which is executed on the user's web browser when the user views the output HTML file.

IBM Corporation

• Internet Scanner 7.0 Service Pack 2 7.2.2005.52 Release

An arbitrary script may be executed on the user's web browser when the user views the report. An arbitrary file in a client PC could be viewed depending on the content of the script.

[Update the Software]

Update the software to the latest version according to the information released by the vendor.
For more information, refer to the vendor's website.

IBM Corporation

• IBM : Top Page

1. Cross-site Scripting(CWE-79) [NVD Evaluation]

1. CVE-2008-1073

1. JVN : JVN#42381549
2. National Vulnerability Database (NVD) : CVE-2008-1073
3. Secunia Advisory : SA29038
4. SecurityFocus : 28014
5. SecurityTracker : 1019508
6. FrSIRT Advisories : FrSIRT/ADV-2008-0681

• [2008/05/21]
    Web page published