Jan Fry and Adrian Pastor have reported a vulnerability in BEA AquaLogic Interaction and BEA Plumtree Foundation, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed to the "name" parameter in portal/server.pt is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

The vulnerability is reported in the following versions:
* BEA AquaLogic Interaction 6.1 through Maintenance Pack 1 on all platforms
* BEA Plumtree Foundation 6.0 through Service Pack 1 on all platforms

Solution
Apply updates.
Further details available to Secunia VIM customers

Provided and/or discovered by
Jan Fry and Adrian Pastor, ProCheckUp Ltd

Changelog
Further details available to Secunia VIM customers

Original Advisory
BEA:
http://dev2dev.bea.com/pub/advisory/259

ProCheckUp Ltd:
http://www.procheckup.com/Vulnerability_PR06-12.php

Deep Links
Links available to Secunia VIM customers