Scalix Web Access is prone to an XML External Entity injection and to a Cross Site Scripting vulnerability.

Attackers can exploit the XML External Entity Injection to obtain potentially sensitive information. This may lead to further attacks. An attacker may leverage the Cross Site Scripting issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Ask the Vendor for an update.

Scalix Web Access versions 11.4.6.12377, and 12.2.0.14697 are vulnerable.

Check the version

• http://www.securityfocus.com/bid/70857
• http://www.securityfocus.com/bid/70859

---

Updated on 2015-03-25