Info

Disclosure

Aug 09, 2011

Discovery

Unknown

Dates

Exploit

Unknown

Solution

Aug 09, 2011

Description

HP WebOS contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate certain unspecified input related to the Contacts application before returning it to the user. This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

Classification

Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Solution: Upgrade
Exploit: Exploit Unknown
Disclosure: Vendor Verified
OSVDB: Web Related

Solution

Upgrade to version 3.0.2 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

Hewlett-Packard Development Company, L.P.

HP webOS

3.0.0

References

CVE ID: 2011-2408 (see also: NVD)
Secunia Advisory ID: 45543
Related OSVDB ID: 74411
Other Advisory URL: http://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c02937744

Credit

Unknown or Incomplete

Direct URL: http://osvdb.org/74412