Reporter Patrick Webster
`LANSA aXes Web Terminal (TN5250) Cross-Site Scripting Vulnerability
LANSA - aXes
"Transform your 5250 applications into GUI browser-based applications
automatically without changing any lines of your source code. Work with
IBM i, System i, iSeries and AS/400 5250 applications securely and efficiently
from browser-based devices running across the Internet, inside your corporate
Intranet or on a mobile network."
Version V1R3M5 / VRM130.000 (135001) has been confirmed as
vulnerable. Other versions untested.
May be used to steal authentication information.
Vendor did not respond.
This vulnerability was discovered by Patrick Webster.
18-Sep-2010 - Discovered during audit.
23-Sep-2010 - Notified vendor. Received automated support ticket.
30-Apr-2011 - Disclosure.
About OSI Security:
OSI Security is an independent network and computer security auditing
and consulting company based in Sydney, Australia. We provide internal
and external penetration testing, vulnerability auditing and wireless
site audits, vendor product assessments, secure network design,
forensics and risk mitigation services.
We can be found at http://www.osisecurity.com.au/