Cross-site scripting (XSS) vulnerability in the viewfile documentation command in Caucho Resin before 3.0.25, and 3.1.x before 3.1.4, allows remote attackers to inject arbitrary web script or HTML via the file parameter.

The remote MiracleLinux 3 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2009-48:01 advisory.

    Resin Open Source provides JSP, Servlet, and EJB functionality under the GPL license.
    Fixed bugs:
    CVE-2008-2462     Cross-site scripting (XSS) vulnerability in the viewfile documentation command in Caucho Resin before     3.0.25, and 3.1.x before 3.1.4, allows remote attackers to inject arbitrary web script or HTML via the     file parameter.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is running Resin, an application server.

The 'viewfile' Servlet included with the version of Resin installed on the remote host fails to sanitize user input to the 'file' parameter before including it in dynamic HTML output.  An attacker may be able to leverage this issue to inject arbitrary HTML and script code into a user's browser to be executed within the security context of the affected site.

Note that the affected Servlet is part of the Resin documentation, which should not be installed on production servers.

The remote web server is running Resin.

This version of Resin is vulnerable to a cross-site scripting flaw via the 'file' parameter of the Viewfile application.  An attacker exploiting this flaw would be able to execute arbitrary script code in the browsers of other Resin users.

ID	Name	Product	Family	Severity
283992	MiracleLinux 3 : resin-3.1.9-1AXS3 (AXSA:2009-48:01)	Nessus	Miracle Linux Local Security Checks	medium
33273	Resin viewfile Servlet file Parameter XSS	Nessus	CGI abuses : XSS	medium
4561	Resin < Viewfile file Parameter XSS	Nessus Network Monitor	Web Servers	medium

Detections

Analytics

CVE-2008-2462

medium

Tenable Plugins

medium

medium

medium