CVE-2010-0640

Vulnerability

CVE-2010-0640 is a cross-site scripting (XSS) vulnerability in CA eHealth Performance Manager versions 6.0.x through 6.2.x [1]. The flaw resides in insufficient validation of certain characters in web interface requests, and is only exploitable when the configuration setting "Scan user input for potentially malicious HTML content" is disabled [1].

Exploitation

An attacker can exploit this vulnerability by crafting a malicious URL containing arbitrary web script or HTML and convincing an unsuspecting user to follow that URL [1]. No authentication is required because the attack relies on social engineering to trigger the XSS.

Impact

Successful exploitation allows a remote attacker to inject arbitrary web script or HTML into the context of the affected web interface, potentially leading to disclosure of sensitive information or execution of actions on behalf of the victim user [1].

Mitigation

To remediate the vulnerability, enable the "Scan user input for potentially malicious HTML content" setting in the eHealth Web Interface configuration [1]. This is done by logging in as Admin, navigating to the "Administration" tab, selecting "Site Configuration", changing the option from "No" to "Yes", and saving [1].