Secunia

Some vulnerabilities have been identified in Macromedia JRun, which can be exploited by malicious people to conduct Cross-Site Scripting attacks.

The vulnerabilities are caused due to missing input validation in "clusterframe.jsp" and "webserverlist.jsp", which are accessible via the JMC interface. This can be exploited to execute arbitrary script code in a user's browser session by tricking the user into visiting a malicious website or clicking a specially crafted link.

Successful exploitation requires that the target user is logged in via JMC on the vulnerable system. This may disclose sensitive information (e.g. cookie-based authentication information) associated with the site running Macromedia JRun.

Example:
http://[victim]:8000/clusterframe.jsp?cluster=<script>alert(document.cookie)</script>

The vulnerabilities have been confirmed in version 4 Build 61650 for Windows. Other versions and other platforms may also be affected.

Solution
The vulnerabilities have been fixed in JRun Updater 3.
Further details available in Customer Area

Provided and/or discovered by
dr_insane

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area