Detections
Analytics
Orion Application Server Web Examples Multiple XSS
medium Nessus Plugin ID 40985
Language:
Synopsis
The remote web server includes at least one JSP application that is affected by a cross-site scripting vulnerability.Description
The remote web server uses Orion Application Server, an application server hosted on a Java2 platform.It currently makes available at least one example JSP application that fails to sanitize user-supplied input before using it to generate dynamic HTML output. Specifically, the 'item' parameter of the 'examples/jsp/sessions/carts.jsp' script, the 'fruit' parameter of 'examples/jsp/checkbox/checkresult.jsp' script, and the 'time' parameter of the 'examples/jsp/cal/cal2.jsp' script are known to be affected. An attacker may be able to leverage this to inject arbitrary HTML and script code into a user's browser to be executed within the security context of the affected site.
Solution
Undeploy the web examples distributed with Orion.See Also
Plugin Details
Severity: Medium
ID: 40985
File Name: orion_examples_xss.nasl
Version: 1.16
Type: remote
Family: CGI abuses : XSS
Published: 9/15/2009
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Risk Information
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N
Vulnerability Information
CPE: cpe:/a:orion:orion_application_server
Excluded KB Items: Settings/disable_cgi_scanning
Exploited by Nessus: true
Vulnerability Publication Date: 9/7/2009