Verity's Search97 contains a Cross-Site Scripting vulnerability in the processing of search requests

2002-06-21T00:00:00
ID VU:636431
Type cert
Reporter CERT
Modified 2002-06-21T14:40:00

Description

Overview

Verity's Search97 application contains a Cross-Site Scripting vulnerability in the processing of search requests.

Description

Verity's Search97 application contains a Cross-Site Scripting vulnerability in the processing of search requests. This vulnerability is in both the Microsoft Window's and UNIX versions of the product. More information about Cross-Site Scripting can be found in CA-2000-02.

It appears that the fault lies in the error pages returned from templates and actions that use either vformat() or vfilter().


Impact

The victim will be presented with information which the compromised site did not wish their visitors to be subjected. This could be used to "sniff" sensitive data from within the web page, including passwords, credit card numbers, and any arbitrary information the user inputs. Likewise, information stored in cookies can be stolen or corrupted.


Solution

According to Verity, this issue is resolved by appling the patch IS37patch18_nti40.zip available to customers at <https://customers.verity.com>.


Vendor Information

636431

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

Verity __ Affected

Notified: April 26, 2002 Updated: April 29, 2002

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

Addendum

According to Verity, this issue iss resolved by appling the patch IS37patch18_nti40.zip available to customers at <https://customers.verity.com>.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

CVSS Metrics

Group | Score | Vector
---|---|---
Base | |
Temporal | |
Environmental | |

References

<http://www.pointblanksecurity.com/css/>

Acknowledgements

This vulnerability was reported by Point Blank Security.

This document was written by Jason Rafail.

Other Information

CVE IDs: | None
---|---
Severity Metric: | 4.50
Date Public: | 2002-03-19
Date First Published: | 2002-06-21
Date Last Updated: | 2002-06-21 14:40 UTC
Document Revision: | 7