Sow Ching Shiong has discovered multiple vulnerabilities in Oracle iPlanet Web Server, which can be exploited by malicious people to conduct cross-site scripting attacks.

1) Input passed via the "helpLogoWidth" and "helpLogoHeight" parameters to admingui/cchelp2/Masthead.jsp (when "mastheadTitle" is set) and the "productNameSrc", "productNameHeight", and "productNameWidth" parameters to admingui/version/Masthead.jsp is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

2) Input passed via the "appName" and "pathPrefix" parameters to admingui/cchelp2/Navigator.jsp is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

NOTE: This vulnerability can also be exploited to conduct script insertion attacks.

The vulnerabilities are confirmed in version 7.0.9 B07/04/2010 02:06. Other versions may also be affected.

Solution
Apply patches available via the support site.

Provided and/or discovered by
Sow Ching Shiong via Secunia.

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html#AppendixSUNS

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers