OSVDB ID: 84588

Title: HP ArcSight Connector / Logger Appliances File Host Data Handling XSS

Info

Disclosure
Aug 06, 2012

Discovery
Unknown

Dates

Exploit
Aug 06, 2012

Solution
Feb 14, 2013

Description

 HP ArcSight Connector and Logger Appliances contain a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the applications do not validate certain input when handling file host data before returning it to the user. This may allow a user to create a specially crafted request that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

Classification

 Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Solution: Upgrade
Exploit: Exploit Public
Disclosure: Uncoordinated Disclosure
OSVDB: Web Related

Solution

 It has been reported that this issue has been fixed. Upgrade HP ArcSight Connector Appliance to version 6.4 or higher and HP ArcSight Logger to version 5.3 or higher to address this vulnerability.

Products

Hewlett-Packard Development Company, L.P.

ArcSight Connector

 6.2.0.6244.0
6.0.0.60023.2

ArcSight Logger Appliances

 5.2.0.6288.0

References

Credit

Unknown or Incomplete


Direct URL: http://osvdb.org/84588