Some vulnerabilities have been reported in Bajie Http Web Server, which can be exploited by malicious people to conduct Cross-Site Scripting attacks against visitors.

The vulnerabilities are caused due to missing input validation. This can be exploited by supplying arbitrary HTML or script code, which will be executed in a user's browser session when viewed.

Example:
http://[victim]/cgi/bin/test.txt?<script>alert(document.cookie)</script>

The "guestName" parameter in "/servlet/custMsg" and "cookiename" parameter in "servlet/CookieExample" can also be exploited.

The vulnerabilities have been reported in version 0.95zxv4. Prior versions may also be affected.

Solution
Update to build 0.95zxv4 or later.

Provided and/or discovered by
Oliver Karow

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area