Visual Paradigm Server 10.0 Cross Site Scripting Vulnerability

================================================================
Visual Paradigm Server v10.0 - Cross Site Scripting (XSS)
================================================================

Information
--------------------
Name: Visual Paradigm Server v10.0 - Cross Site Scripting (XSS)
Affected Software : Visual Paradigm Server
Affected Versions: 10.0
Vendor Homepage : http://www.visual-paradigm.com
Vulnerability Type : Cross Site Scripting
Severity : Low
CVE: n/a


Product
--------------------
Visual Paradigm Server is a service that is installed with Visual 
Paradigm Teamwork Server. It is used to manage the license server accounts.


Description
--------------------
A vulnerability has been detected in login.jsp  that allow an attacker 
execute arbitrary javascript in the browser context of a victim and 
could steal the cookie of a user and hijack his session.


Proof of Concept URL
--------------------
http://site:1999/login.jsp?error=Invalid 
login&user="/><script>alert("XSS");</script>


Solution
--------------------
Install a higher version, the last version is 12.2


Advisory Timeline
--------------------

26/11/2015 - Informed vendor about the issue
26/11/2015 - Vendor responded
27/11/2015 - Vendor say that just this version (10.0) is affected by 
this vulnerability, and this version is deprecated. (Also I reported 
other XSS in his website and they fixed)
27/11/2015 - Vulnerability published

#  0day.today [2018-02-16]  #