|
Citrix Web Interface On-line Help Feature Cross Site Scripting Vulnerability |
|
Thursday, 20 December 2007
by Michel Roth
|
|
A vulnerability has been reported in Citrix Web Interface, which can be exploited by malicious people to conduct cross-site scripting attacks. Don't worry to much, you're only in a tight spot if you run a reallly old version of WI.
Certain unspecified input in the on-line help is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
The vulnerability affects the following products, which according to the vendor have already reached End-of-Life:
• Citrix NFuse - all versions
• Citrix Web Interface up to and including version 2.0
Check out the original advisory.
|
