search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Hummingbird CyberDOCS contains multiple cross-site scripting vulnerabilities

Vulnerability Note VU#488684

Original Release Date: 2003-10-09 | Last Revised: 2003-10-14


Hummingbird CyberDOCS contains cross site scripting vulnerabilities that could allow an attacker to obtain sensitive information and possibly impersonate legitimate users.


Hummingbird CyberDOCS (Hummingbird DM) is a web-based enterprise document management solution that runs on Windows NT/2000 using SQL database technology. Several web pages return user input from URI or POST query parameters without adequate filtering. By convincing a user to access a crafted URI or web page, a remote attacker could execute HTML and script within the trust domain of the CyberDOCS web server.


A remote attacker could access sensitive information related to the vulnerable web page (cookies, form values, URI data). The attacker could also attempt to mislead the user into providing sensitive information such as login credentials.


Apply a patch or upgrade

For CyberDOCS 4.0, apply Patch 4 from the CyberDOCS support site. For versions of CyberDOCS prior to 4.0, Hummingbird recommends that customers upgrade to the most recent version of CyberDOCS.

Vendor Information


Hummingbird Affected

Notified:  September 18, 2003 Updated: October 09, 2003



Vendor Statement

CyberDOCS - Potential to Embed Scripts That Can Communicate with Other Sites in URL

Problem: In CyberDOCS (versions 3.5.1, 3.9, and 4.0), the application does not escape certain URL/POST page query parameters before embedding them in the HTML output. This allows users the potential ability to insert scripts that can be written to communicate with other sites.

Resolution: This issue is resolved in CyberDOCS 4.0 Patch 4, which can be downloaded from Hummingbird's website at the following location:


Reference: SD017079

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.


The CERT/CC has no additional comments at this time.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

CVSS Metrics

Group Score Vector



This vulnerability was discovered and reported by ProCheckUp.

This document was written by Art Manion.

Other Information

CVE IDs: None
Severity Metric: 1.95
Date Public: 2003-10-06
Date First Published: 2003-10-09
Date Last Updated: 2003-10-14 18:49 UTC
Document Revision: 25

Sponsored by CISA.