Summary
This web application is running with the Vaadin Framework which is prone to a Cross-Site Scripting vulnerability.
Impact
Successful exploitation will allow remote attackers to execute arbitrary HTML and script code in a user's browser session in the context of an affected application.
Solution
Upgrade to Vaadin Framework version 6.4.9 or later For updates refer to http://vaadin.com/releases
Insight
Input passed to the 'URL' parameter in 'index.php', is not properly sanitised before being returned to the user.
Affected
Vaadin Framework versions from 6.0.0 up to 6.4.8
Detection
Check the version.
References
Severity
Classification
-
CVE CVE-2011-0509 -
CVSS Base Score: 4.3
AV:N/AC:M/Au:N/C:N/I:P/A:N
Related Vulnerabilities
- @Mail WebMail Email Body HTML Injection Vulnerability
- Adobe ColdFusion Multiple Cross Site Scripting Vulnerabilities
- Apache Tomcat 'sendfile' Request Attributes Information Disclosure Vulnerability
- Adobe ColdFusion Multiple Full Path Disclosure Vulnerabilities
- Adiscon LogAnalyzer 'highlight' Parameter Cross Site Scripting Vulnerability