Crystal Reports Server InfoView logonAction Parameter XSS

This script is Copyright (C) 2011-2014 Tenable Network Security, Inc.


Synopsis :

The remote web server hosts a JSP script that is prone to a cross-
site scripting attack.

Description :

The InfoView component included with the Crystal Reports Server
install on the remote host contains a JSP script fails to sanitize
user input to the 'logonAction' parameter of its 'logon.jsp' script
before using it to generate dynamic HTML output.

An attacker may be able to leverage this issue to inject arbitrary
HTML or script code into a user's browser to be executed within the
security context of the affected site.

Note that this install is likely affected by other cross-site
scripting issues as well as a directory traversal vulnerability,
although Nessus has not checked for them.

See also :

http://dsecrg.com/pages/vul/show.php?id=301
http://archives.neohapsis.com/archives/bugtraq/2011-01/0159.html
http://www.nessus.org/u?cde1ca7a

Solution :

See https://service.sap.com/sap/support/notes/1458310 (requires
credentials).

Risk factor :

Medium / CVSS Base Score : 4.3
(CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS Temporal Score : 3.6
(CVSS2#E:F/RL:OF/RC:C)
Public Exploit Available : true

Family: CGI abuses : XSS

Nessus Plugin ID: 51816 ()

Bugtraq ID: 45980

CVE ID: