JVN#58020495: Research Artisan Lite vulnerable to cross-site scripting

Research Artisan Lite provided by Research Artisan Project is an access analysis tool. Research Artisan Lite contains multiple cross-site scripting vulnerabilities (CWE-79).

Impact

There are two attack scenarios.

1. If a user views a malicious web page, an arbitrary script may be executed on the user’s web browser.
2. An attacker accesses a specially crafted URL which may include javascript code. The server then stores the access logs for analysis. When an administrator views the analysis results, a script is executed on the administrator’s web browser.

Solution

Update the Software
Update to the latest version according to the information provided by the developer.

Products Affected

• Research Artisan Lite prior to ver.1.18