A new security vulnerability has been reported in Lotus Quickr (Domino):
Secunia Advisory: SA31634This is fixed in Quickr Hotfix 15 and above, so I suggest you update to the latest Hotfix ASAP.
Release Date: 2008-08-27
Impact: Cross Site Scripting
Where: From remote
Solution Status: Vendor Patch
Software: IBM Lotus Quickr 8.x
Some vulnerabilities have been reported in IBM Lotus Quickr, which can be exploited by malicious people to conduct cross-site scripting attacks.
Input via unspecified parameters e.g. when creating a local group, adding a page using "Imported Page", in the WYSIWYG editors, in the html import functionality, and in the Rich text editor is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
The vulnerability is reported in Lotus Quickr 8.1. Other versions may also be affected.
Update to Lotus Quickr 8.1 Hotfix 15 or later.
Provided and/or discovered by:
Reported by the vendor.
By: Quickr Blog (Stuart McIntyre) | 0 Comments | On: 3 September 2008 21:45:34 | Tags: quickr lotus hotfix