JVN#11424086: Password Vault Web Access vulnerable to cross-site scripting

Password Vault Web Access (PVWA) is a module in the Privileged Identity Management Suite that allows access via a web portal. PVWA contains a cross-site scripting vulnerability.

Impact

An arbitrary script may be executed on the web browser of an user who is logged on.

Solution

Apply a patch
Apply the appropriate patch according to the information provided by the developer.

Products Affected

• PVWA v6.0 releases v6.0 patch #2 and earlier

• PVWA v5.5 releases v5.5 patch #4 and earlier

• PVWA v5.0 and earlier