Detections
Analytics
Sun Java System Calendar Server login.wcap Fmt-out Parameter XSS
medium Nessus Plugin ID 38913
Language:
Synopsis
The remote web server uses a script that is affected by a cross-site scripting vulnerability.Description
The version of Sun Java System Calendar Server running on the remote host fails to sanitize input to the 'Fmt-out' parameter of the 'login.wcap' script before using it to generate dynamic HTML output.An attacker may be able to leverage this to inject arbitrary HTML and script code into a user's browser to be executed within the security context of the affected site.
Note that this install is also likely to be affected by other vulnerabilities, although Nessus has not checked for them.
Solution
Apply the appropriate patch referenced in the vendor advisory above.See Also
http://www.coresecurity.com/content/sun-calendar-express
https://www.securityfocus.com/archive/1/502320/30/0/threaded
Plugin Details
Severity: Medium
ID: 38913
File Name: sun_calendar_server_fmt_out_xss.nasl
Version: 1.19
Type: remote
Family: CGI abuses : XSS
Published: 5/27/2009
Updated: 1/19/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.8
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.7
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
Vulnerability Information
Exploit Ease: No exploit is required
Exploited by Nessus: true
Patch Publication Date: 3/31/2009
Reference Information
CVE: CVE-2009-1218
BID: 34152