Freely subscribe to our NEWSLETTER

This bulletin was written by Vigil@nce : http://vigilance.fr/offer

SYNTHESIS OF THE VULNERABILITY

An attacker can trigger a Cross Site Scripting in the search
feature of IIS, in order to execute JavaScript code in the context
of the web site.

Impacted products: IIS

Severity: 2/4

Creation date: 01/12/2014

DESCRIPTION OF THE VULNERABILITY

The IIS product implements a web service.

However, it does not filter received "search=" data before
inserting them in generated HTML documents. They are truncated
after 20 bytes.

An attacker can therefore trigger a Cross Site Scripting in the
search feature of IIS, in order to execute JavaScript code in the
context of the web site.

ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN

http://vigilance.fr/vulnerability/IIS-Cross-Site-Scripting-of-search-15725