CVE-2007-0437: XSS
Multiple cross-site scripting (XSS) vulnerabilities in the sample Cache' Server Page (CSP) scripts in InterSystems Cache' allow remote attackers to inject arbitrary web script or HTML via (1) the TO parameter to loop.csp, (2) the VALUE parameter to cookie.csp, and (3) the PAGE parameter to showsource.csp in csp/samples/; and allow remote authenticated users to inject arbitrary web script or HTML via (4) the ERROR parameter to csp/samples/xmlclasseserror.csp, and unspecified vectors in (5) object.csp and (6) lotteryhistory.csp in csp/samples/.
Affected Software
Event History
Frequently Asked Questions
What are the cross-site scripting vulnerabilities associated with CVE-2007-0437?
CVE-2007-0437 describes multiple cross-site scripting vulnerabilities in InterSystems Cache' that allow remote attackers to inject arbitrary scripts through specific parameters in sample CSP scripts.
How can I mitigate CVE-2007-0437 vulnerabilities?
To mitigate CVE-2007-0437, ensure that input validation and output encoding is properly implemented for the affected parameters in the Cache' Server Page scripts.
What software versions are affected by CVE-2007-0437?
CVE-2007-0437 affects all versions of InterSystems Cache Database that contain the vulnerable sample Cache' Server Page scripts.
Is CVE-2007-0437 a critical vulnerability?
CVE-2007-0437 is considered a moderate severity vulnerability due to its potential for exploitation through cross-site scripting.
What steps should I take if I am using InterSystems Cache Database affected by CVE-2007-0437?
If using an affected version of InterSystems Cache Database, review and secure the sample CSP scripts against XSS attacks as a priority.