JVN#17298485 Mayaa cross-site scripting vulnerability

Overview

Mayaa from Seasar Project contains a cross-site scripting vulnerability.

Products Affected

Mayaa 1.1.22 and earlier

Description

Mayaa from Seasar Project is an open source Java template engine. The default error page that Mayaa displays contains a cross-site scripting vulnerability.

Impact

An arbitrary script may be executed on the user's web browser.

Solution

Update the software
Apply the latest update provided by the developers

Workarounds
Create a template for the error page until update is completed.

Vendor Status

Vendor	Link
Mayaa	Cross-site scripting vulnerability in Mayaa 1.1.22 and earlier (Japanese Only)

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

Analyzed on 2008.12.25

Measures	Conditions	Severity
Access Required	Routed - can be attacked over the Internet using packets	High
Authentication	None - anonymous or no authentication (IP addresses do not count)	High
User Interaction Required	None - the vulnerability can be exploited without an honest user taking any action	High
Exploit Complexity	Low - little to no expertise and/or luck required to exploit (cross-site scripting)	High

Description of each analysis measures

Credit

Tetsuo Nakamura of NEC Soft,Ltd. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE	CVE-2008-5720
JVN iPedia	JVNDB-2008-000085

Update History