----------------------------------------------------------------------

Want a new job?

http://secunia.com/secunia_security_specialist/
http://secunia.com/hardcore_disassembler_and_reverse_engineer/

International Partner Manager - Project Sales in the IT-Security
Industry:
http://corporate.secunia.com/about_secunia/64/

----------------------------------------------------------------------

TITLE:
IBM Workplace Unspecified Cross-Site Scripting and Request Forgery

SECUNIA ADVISORY ID:
SA30433

VERIFY ADVISORY:
http://secunia.com/advisories/30433/

CRITICAL:
Less critical

IMPACT:
Cross Site Scripting

WHERE:
>From remote

SOFTWARE:
IBM Workplace for Business Controls and Reporting 2.x
http://secunia.com/product/19009/
IBM Workplace Web Content Management 6.x
http://secunia.com/product/19007/

DESCRIPTION:
Some vulnerabilities have been reported in IBM Workplace, which can
be exploited by malicious people to conduct cross-site scripting and
cross-site request forgery attacks.

1) Unspecified input is not properly sanitised before being returned
to the user. This can be exploited to execute arbitrary HTML and
script code in a user's browser session in context of an affected
site.

2) The application allows user to perform certain actions via HTTP
requests, without performing any validity checks to verify the
request. This can be exploited to perform actions with the privileges
of a target user, who is e.g. tricked into visiting a malicious
website.

SOLUTION:
Do not follow untrusted links or browse untrusted web sites while
being logged in to the application, and filter malicious characters
and character sequences in a web proxy.

PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.

ORIGINAL ADVISORY:
http://www-1.ibm.com/support/docview.wss?uid=swg1PJ33180

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------