Visual Paradigm Server 10.0 Cross Site Scripting

`================================================================  
Visual Paradigm Server v10.0 - Cross Site Scripting (XSS)  
================================================================  
  
Information  
--------------------  
Name: Visual Paradigm Server v10.0 - Cross Site Scripting (XSS)  
Affected Software : Visual Paradigm Server  
Affected Versions: 10.0  
Vendor Homepage : http://www.visual-paradigm.com  
Vulnerability Type : Cross Site Scripting  
Severity : Low  
CVE: n/a  
  
  
Product  
--------------------  
Visual Paradigm Server is a service that is installed with Visual   
Paradigm Teamwork Server. It is used to manage the license server accounts.  
  
  
Description  
--------------------  
A vulnerability has been detected in login.jsp that allow an attacker   
execute arbitrary javascript in the browser context of a victim and   
could steal the cookie of a user and hijack his session.  
  
  
Proof of Concept URL  
--------------------  
http://site:1999/login.jsp?error=Invalid   
login&user="/><script>alert("XSS");</script>  
  
  
Solution  
--------------------  
Install a higher version, the last version is 12.2  
  
  
Advisory Timeline  
--------------------  
  
26/11/2015 - Informed vendor about the issue  
26/11/2015 - Vendor responded  
27/11/2015 - Vendor say that just this version (10.0) is affected by   
this vulnerability, and this version is deprecated. (Also I reported   
other XSS in his website and they fixed)  
27/11/2015 - Vulnerability published  
  
  
Credits & Authors  
--------------------  
Manuel Mancera (@sinkmanu)  
  
www.a2secure.com  
  
  
Disclaimer  
-------------------  
All information is provided without warranty. The intent is to provide  
information to secure infrastructure and/or systems, not to be able to  
attack or damage. Therefore A2Secure shall not be liable for any direct  
or indirect damages that might be caused by using this information.  
`