Sun Java System Identity Manager Multiple XSS

This script is Copyright (C) 2008-2012 Tenable Network Security, Inc.


Synopsis :

The remote web server contains an application that is affected by
multiple cross-site scripting vulnerabilities.

Description :

The remote host is running Sun Java System Identity Manager, a Java
application for user provisioning and identity auditing in enterprise
environments.

The version of Identity Manager installed on the remote host fails to
sanitize user-supplied input to various JSP scripts before using it to
generate dynamic content. An unauthenticated, remote attacker may be
able to leverage these issues to inject arbitrary HTML or script code
into a user's browser to be executed within the security context of
the affected site.

Known to be affected are the 'cntry' and 'lang' parameters of the
'login.jsp' script, the 'resultsForm' parameter of the
'account/findForSelect.jsp' script, the 'activeControl' parameter of
the 'user/main.jsp' script, the 'helpUrl' parameter of the
'help/index.jsp' script, and the 'nextPage' parameter of the
'user/login.jsp' script

See also :

http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr07-06
http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr07-07
http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr07-08
http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr07-09
http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr07-10
http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr07-12
http://www.securityfocus.com/archive/1/486076
http://www.nessus.org/u?9ebbdd8a

Solution :

Upgrade to one of the versions of Sun Java System Identity Manager
listed in the vendor's advisory.

Risk factor :

Medium / CVSS Base Score : 4.3
(CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS Temporal Score : 3.6
(CVSS2#E:F/RL:OF/RC:C)
Public Exploit Available : true

Family: CGI abuses : XSS

Nessus Plugin ID: 29926 ()

Bugtraq ID: 27214

CVE ID: CVE-2008-0239
CVE-2008-0240
CVE-2008-0241