CVE-2011-1825

Vulnerability

Multiple cross-site scripting (XSS) vulnerabilities exist in the Administrative Console of CA Arcot WebFort Versatile Authentication Server (VAS) versions prior to 6.2.5. The vulnerabilities allow remote attackers to inject arbitrary web script or HTML via unspecified vectors in the administrative interface. Affected versions are all releases before 6.2.5 [1].

Exploitation

An unauthenticated remote attacker can send crafted requests to the Administrative Console to inject malicious script or HTML. The exact attack vectors are not publicly detailed, but the reference notes that the vulnerabilities are remotely exploitable without authentication [1].

Impact

Successful exploitation enables an attacker to execute arbitrary script or HTML in the context of the administrative console, potentially leading to credential theft, session hijacking, or defacement of administrative pages. The attacker could also target other administrators viewing the console.

Mitigation

CA Arcot WebFort VAS version 6.2.5 contains fixes for these XSS vulnerabilities. Users should upgrade to 6.2.5 or later as soon as possible [1]. No workaround has been documented.