A vulnerability has been reported in Caucho Resin, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed via the "file" parameter to the "viewfile" command included in the the Resin documentation is not properly sanitised before being returned to a user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

NOTE: The vendor reportedly does not recommend including the Resin documentation on production web servers.

Solution
Update to version 3.0.25 or 3.1.4.

Provided and/or discovered by
Tomasz Kuczynski, reported via US-CERT.

Original Advisory
Caucho Resin (#2214):
http://www.caucho.com/resin/changes/changes-31.xtp#3.1.4%20-%20Dec%205,%202007

US-CERT VU#305208:
http://www.kb.cert.org/vuls/id/305208

Deep Links
Links available in Customer Area