PT-2011-3271 · Grapecity · Data Dynamics Reports

Published 2011-04-10 · Updated 2018-10-09 · CVE-2011-1660

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions GrapeCity Data Dynamics Reports versions prior to 1.6.2084.14

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the DataDynamics.Reports.Web class library. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific parameters to certain JavaScript files, as reachable by CoreHandler.ashx. The vulnerable parameters include reportName, uniqueId, and traceLevel in CoreViewerInit.js and CoreController.js.

Recommendations For versions prior to 1.6.2084.14, update to version 1.6.2084.14 or later to resolve the issue. As a temporary workaround, consider restricting access to the CoreHandler.ashx endpoint and limiting the use of the reportName, uniqueId, and traceLevel parameters in CoreViewerInit.js and CoreController.js until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2011-1660

Affected Products

Data Dynamics Reports

References · 8

• 🔥 http://securityfocus.com/bid/47015 · Exploit
• http://secunia.com/advisories/43953 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-1660 · Security Note
• http://gcpowertools.com/DownloadLatestVersion · Patch
• http://osvdb.org/71488 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66545 · Note
• http://securityreason.com/securityalert/8190 · Note
• http://securityfocus.com/archive/1/517244/100/0/threaded · Note