PT-2010-1650 · Toutvirtual · Toutvirtual Virtualiq Pro
Published
2010-05-07
·
Updated
2010-05-21
·
CVE-2009-4842
CVSS v2.0
4.3
Medium
| Vector | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
ToutVirtual VirtualIQ Pro version 3.5 build 8691
Description
The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved via several parameters in different API endpoints, including
addNewDept, deptId, deptDesc in the /tvserver/server/user/addDepartment.jsp endpoint, or firstName, lastName, email in a save action to the /tvserver/user/user.do endpoint.Recommendations
For ToutVirtual VirtualIQ Pro version 3.5 build 8691, consider restricting access to the vulnerable API endpoints, such as
/tvserver/server/user/addDepartment.jsp and /tvserver/user/user.do, until a patch is available. As a temporary workaround, avoid using the parameters addNewDept, deptId, deptDesc, firstName, lastName, email in the affected endpoints to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Toutvirtual Virtualiq Pro