Detections
Analytics
BEA Plumtree portal/server.pt name Parameter XSS
medium Nessus Plugin ID 31120
Language:
Synopsis
The remote web server contains an application affected by a cross-site scripting vulnerability.Description
The version of the Plumtree portal included with BEA AquaLogic Interaction / Plumtree Foundation and installed on the remote host fails to sanitize user-supplied input to the 'name' parameter of the 'portal/server.pt' script before using it to generate dynamic HTML output. An unauthenticated attacker can exploit this to inject arbitrary HTML and script code into a user's browser to be executed within the security context of the affected site.Solution
Apply the appropriate patch as suggested in the vendor advisory above.See Also
http://www.nessus.org/u?713eaf97
Plugin Details
Severity: Medium
ID: 31120
File Name: plumtree_name_xss.nasl
Version: 1.18
Type: remote
Family: CGI abuses : XSS
Published: 2/20/2008
Updated: 4/11/2022
Configuration: Enable thorough checks
Supported Sensors: Nessus
Vulnerability Information
CPE: cpe:/a:bea_systems:plumtree_collaboration
Excluded KB Items: Settings/disable_cgi_scanning
Exploit Available: true
Exploit Ease: Exploits are available
Reference Information
BID: 27893