The Quickr Blog

A new security vulnerability has been reported in Lotus Quickr (Domino):

Secunia Advisory:            SA31634            
Release Date:         2008-08-27

Critical:        
Less critical
Impact:         Cross Site Scripting
Where:         From remote
Solution Status:         Vendor Patch

Software:        IBM Lotus Quickr 8.x

Description:
Some vulnerabilities have been reported in IBM Lotus Quickr, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input via unspecified parameters e.g. when creating a local group, adding a page using "Imported Page", in the WYSIWYG editors, in the html import functionality, and in the Rich text editor is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerability is reported in Lotus Quickr 8.1. Other versions may also be affected.

Solution:
Update to Lotus Quickr 8.1 Hotfix 15 or later.

Provided and/or discovered by:
Reported by the vendor.

Original Advisory:
http://www-01.ibm.com/support/docview.wss?uid=swg27013341

This is fixed in Quickr Hotfix 15 and above, so I suggest you update to the latest Hotfix ASAP.

By: Quickr Blog (Stuart McIntyre) | 0 Comments | On: 3 September 2008 21:45:34 | Tags:  quickr  lotus  hotfix 

Comments

No Comments Found