search menu icon-carat-right cmu-wordmark

CERT Coordination Center

CA Siteminder login.fcc form xss vulnerability

Vulnerability Note VU#713012

Original Release Date: 2011-12-07 | Last Revised: 2011-12-09


CA Siteminder R6 SP6 CR7, R12 SP3 CR8 and possibly previous versions, are vulnerable to a reflective cross site scripting (XSS) vulnerability.


According to CA's website: "CA SiteMinder provides a centralized security management foundation that enables the secure use of the web to deliver applications and cloud services to customers, partners, and employees." CA Siteminder software fails to sanitize POST requests sent to the login.fcc form. As a result, stored and reflective cross site scripting (XSS) attacks can be conducted. An attacker can inject javascript code that will be run each time the specified webpage is accessed by inserting javascript code in the affected parameter. According to the reporter the login.fcc webpage and postpreservationdata parameter is affected by a reflective XSS vulnerability, postpreservationdata=fail&target="><script>alert(1)</script><"


An attacker with access to the CA Siteminder can conduct a cross site scripting attack, which could be used to result in information leakage, privilege escalation, and/or denial of service.


The vendor has confirmed that this vulnerability has been addressed in SiteMinder R6 SP6 CR8 and SiteMinder R12 SP3 CR9.

Restrict access

As a general good security practice, only allow connections from trusted hosts and networks. Note that restricting access does not prevent XSS or CSRF attacks since the attack comes as an HTTP request from a legitimate user's host. Restricting access would prevent an attacker from accessing a CA Siteminder using stolen credentials from a blocked network location.

Vendor Information


Computer Associates Affected

Notified:  October 05, 2011 Updated: December 09, 2011



Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has confirmed that this vulnerability has been address in SiteMinder R6 SP6 CR8 and SiteMinder R12 SP3 CR9.

CVSS Metrics

Group Score Vector



Thanks to Jon Passki of Aspect Security for reporting this vulnerability.

This document was written by Michael Orlando.

Other Information

CVE IDs: CVE-2011-4054
Severity Metric: 0.14
Date Public: 2011-12-07
Date First Published: 2011-12-07
Date Last Updated: 2011-12-09 14:00 UTC
Document Revision: 18

Sponsored by CISA.