|
Description
|
|
Multiple vulnerabilities have been discovered in Perforce Web Client (P4Web), which can be exploited by malicious people to conduct cross-site scripting attacks.
1) Input passed via multiple GET parameters to various web interface sections (when "ac" is set to the respective section) is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
List of affected scripts and parameters:
<a href="http://[host]/@&cl
" target="_blank">http://[host]/@&cl
</a>
<a href="http://[host]/@&cnm&cdu&cow&cda&cho
" target="_blank">http://[host]/@&cnm&cdu&cow&cda&cho
</a>
<a href="http://[host]/@&unm&udu&uda
" target="_blank">http://[host]/@&unm&udu&uda
</a>
<a href="http://[host]/@&pat
" target="_blank">http://[host]/@&pat
</a>
<a href="http://[host]/@&bnm&bow&bdu&bda
" target="_blank">http://[host]/@&bnm&bow&bdu&bda
</a>
<a href="http://[host]/@&lnm&low&ldu&lda
" target="_blank">http://[host]/@&lnm&low&ldu&lda
</a>
<a href="http://[host]/@&ft
" target="_blank">http://[host]/@&ft
</a>
<a href="http://[host]/@&pat&sr&u&cl
" target="_blank">http://[host]/@&pat&sr&u&cl
</a>
2) Input appended to the URL after e.g. <a href="http://[host]/@@ (when "ac" is set to a valid section) is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
" target="_blank">http://[host]/@@ (when "ac&...ntext of an affected site.
</a>
The vulnerabilities are confirmed in version 2011.1. Other versions may also be affected.
|
|
|
|
|
|
Vulnerable Products
|
|
Vulnerable Software:
Perforce Web Client (P4Web)
|
|
|
|
|
|
Solution
|
|
Update to version 2012.1 or later.
|
|
|
|
|
|
CVE
|
|
|
|
|
|
|
|
References
|
|
http://packetstormsecurity.com/files/119737/Perforce-P4web-2011-2012-Web-Client-Cross-Site-Scripting.html
|
|
|
|
|
|
Vulnerability Manager Detection
|
|
No
|
|
|
|
|
|
IPS Protection
|
|
|
|
|
|
|
