Signature Detail
Short Name |
HTTP:XSS:HTML-SCRIPT-IN-COOKIE |
|---|---|
Severity |
High |
Recommended |
Yes |
Category |
HTTP |
Keywords |
HTML Script Tag Embedded in Cookie |
Release Date |
2009/11/24 |
Update Number |
1551 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
HTTP: HTML Script Tag Embedded in Cookie
This signature detects attempts at cross-site scripting attacks. Attackers can create a malicious Web site that includes HTML embedded in the hyperlinks, which can violate site security settings. A victim that accesses these hyperlinks can allow the attacker to view the victim's Web cookies. Web cookies typically contain sensitive information.
Extended Description
Computer Associates SiteMinder Web Agent is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. Exploiting this issue allows attackers to execute arbitrary HTML or script code in a user's browser session in the context of an affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. We were not told which versions are affected. We will update this BID as more information emerges.
Affected Products
- Computer Associates SiteMinder 6.0
- Computer Associates SiteMinder
- Computer Associates SiteMinder Web Agent
References
- BugTraq: 26375
- CERT: CA-2000-02
- CVE: CVE-2015-1628
- CVE: CVE-2007-5923