Vulnerability Note VU#636431

Verity's Search97 contains a Cross-Site Scripting vulnerability in the processing of search requests

Original Release date: 21 Jun 2002 | Last revised: 21 Jun 2002

Overview

Verity's Search97 application contains a Cross-Site Scripting vulnerability in the processing of search requests.

Description

Verity's Search97 application contains a Cross-Site Scripting vulnerability in the processing of search requests. This vulnerability is in both the Microsoft Window's and UNIX versions of the product. More information about Cross-Site Scripting can be found in CA-2000-02.

It appears that the fault lies in the error pages returned from templates and actions that use either vformat() or vfilter().

Impact

The victim will be presented with information which the compromised site did not wish their visitors to be subjected. This could be used to "sniff" sensitive data from within the web page, including passwords, credit card numbers, and any arbitrary information the user inputs. Likewise, information stored in cookies can be stolen or corrupted.

Solution

According to Verity, this issue is resolved by appling the patch IS37patch18_nti40.zip available to customers at https://customers.verity.com.

Systems Affected (Learn More)

VendorStatusDate NotifiedDate Updated
VerityAffected26 Apr 200229 Apr 2002
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base N/A N/A
Temporal N/A N/A
Environmental N/A N/A

References

Credit

This vulnerability was reported by Point Blank Security.

This document was written by Jason Rafail.

Other Information

  • CVE IDs: Unknown
  • Date Public: 19 Mar 2002
  • Date First Published: 21 Jun 2002
  • Date Last Updated: 21 Jun 2002
  • Severity Metric: 4.50
  • Document Revision: 6

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.