Info

Disclosure

Nov 01, 2005

Discovery

Apr 07, 2005

Dates

Exploit

Unknown

Solution

Unknown

Description

Ringtail CaseBook contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'users' variable upon submission to the 'login.asp' script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

Classification

Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Exploit: Exploit Unknown
Disclosure: OSVDB Verified
OSVDB: Web Related

Solution

Upgrade to version 2005 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

FTI Consulting, Inc.

Ringtail CaseBook

6.1.0

References

Secunia Advisory ID: 17383
CVE ID: 2005-3479 (see also: NVD)
Related OSVDB ID: 20422
Other Advisory URL: http://www.procheckup.com/Vulner_PR0412.php
Vendor URL: http://www.ringtailsolutions.com/

Credit

Gemma Hughes - gemma.hughesprocheckup.com - ProCheckUp

Direct URL: http://osvdb.org/20423