{"vuid":"VU#114070","idnumber":"114070","name":"NetScreen Instant Virtual Extranet (IVE) platform contains cross-site scripting vulnerability in delhomepage.cgi","keywords":["NetScreen","Instant Virtual Extranet","IVE","cross-site scripting","css","row parameter","delhomepage.cgi"],"overview":"NetScreen Instant Virtual Extranet (IVE) platform contains a cross-site scripting vulnerability in the row parameter of delhomepage.cgi, which could allow an attacker to mount a cross-site scripting attack.","clean_desc":"The Instant Virtual Extranet platform is an application security gateway that includes a built-in web server. The delhomepage.cgi script does not adequately validate the value of the row parameter. It is possible to use a cross-site scripting technique to inject malicious script (JavaScript, VBScript, etc.) or HTML into a web page using a specially crafted row parameter. According to NetScreen: The scope of the problem is limited because only authenticated users can access the affected URL.","impact":"A remote attacker could access sensitive information related to the vulnerable web page (cookies, form values, URI data). The attacker could also attempt to mislead the user into providing sensitive information such as login credentials.","resolution":"Apply Patch\nNetScreen has provided a patch to address this vulnerability. For details on obtaining the patch corresponding to your currently installed release, please refer to the NetScreen Advisory.","workarounds":"","sysaffected":"","thanks":"This vulnerability was reported by Mark Lachniet.","author":"This document was written by Damon Morda.","public":["http://www.netscreen.com/services/security/alerts/ive_xss.txt","http://secunia.com/advisories/11025/","http://www.cert.org/archive/pdf/cross_site_scripting.pdf","http://www.neoteris.com/products/functoverview.html"],"cveids":[""],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2004-03-03T18:18:28Z","publicdate":"2004-03-02T00:00:00Z","datefirstpublished":"2004-03-09T21:24:16Z","dateupdated":"2004-03-09T21:24:26Z","revision":12,"vrda_d1_directreport":"","vrda_d1_population":"","vrda_d1_impact":"","cam_widelyknown":"15","cam_exploitation":"0","cam_internetinfrastructure":"4","cam_population":"6","cam_impact":"8","cam_easeofexploitation":"12","cam_attackeraccessrequired":"5","cam_scorecurrent":"1.026","cam_scorecurrentwidelyknown":"1.296","cam_scorecurrentwidelyknownexploited":"2.376","ipprotocol":"","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":1.026,"vulnote":null}