CVE-2015-7349

Cross-site scripting (XSS) vulnerability in the sample feedback.inc file in VASCO DIGIPASS authentication plug-in for Citrix Web Interface allows remote attackers to inject arbitrary web script or HTML via the failmessage parameter.
References
Link Resource
https://labs.integrity.pt/advisories/cve-2015-7349/index.html Exploit Mitigation Technical Description Third Party Advisory
https://www.vasco.com/images/de-de/KB_140148_tcm45-47825.pdf Exploit Mitigation Technical Description Vendor Advisory
https://www.vasco.com/support/knowledge-base-articles/kb-140148.html Exploit Mitigation Technical Description Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:vasco:digipass:-:*:*:*:*:citrix_web:*:*

History

No history.

Information

Published : 2017-09-28 01:29

Updated : 2024-02-04 19:29


NVD link : CVE-2015-7349

Mitre link : CVE-2015-7349

CVE.ORG link : CVE-2015-7349


JSON object : View

Products Affected

vasco

  • digipass
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')