Two vulnerabilities have been reported in the Blue Coat ProxySG SGOS, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed to the "name" parameter in install_upload_action/crl_format and to the "file" parameter in install_upload_from_file.htm is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerabilities are reported in versions prior to 4.2.6.1 and 5.2.2.5.

Solution
Update to version 4.2.6.1 or 5.2.2.5.

Provided and/or discovered by
The vendor credits Adrian Pastor of ProCheckUp.

Changelog
Further details available in Customer Area

Original Advisory
Blue Coat:
http://www.bluecoat.com/support/securityadvisories/advisory_cross-site_scripting_vulnerability

ProCheckUp:
http://www.procheckup.com/Vulnerability_PR07-29.php

Deep Links
Links available in Customer Area