Multiple security issues and vulnerabilities have been reported in Kerwin, which can be exploited by malicious users to gain knowledge of potentially sensitive information, bypass certain security restrictions and by malicious people to conduct cross-site scripting and SQL injection attacks.

1) Input passed via the "evtvariablename" parameter to kw.dll is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

2) Certain input used for searching and displaying content is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

3) The application improperly restricts access to certain charts, dashboards, and scheduled tasks via synoptics when using the Win GUI, which can be exploited to access otherwise restricted information.

4) Input passed via the username when logging in is not properly sanitised before being used in a SQL query. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

5) The application improperly restricts access to certain synoptics objects associated to user's workgroups via the Win GUI when being set to display as image or label, which can be exploited to access synoptics objects of otherwise restricted workgroups.

6) An error when handling the setting of a homepage via the Web GUI can be exploited to gain knowledge of otherwise restricted objects.

The security issues and the vulnerabilities are reported in versions prior to 6.0.1.

Solution
Upgrade to version 6.0.1 or later.

Provided and/or discovered by
1, 2) phocean
3-6) Reported by the vendor.

Changelog
Further details available to Secunia VIM customers

Original Advisory
Kerwin:
http://download.schneider-electric.com/files?p_File_Id=25572916&p_File_Name=Release-Notes-Kerwin-6.0.4.pdf

Phocean:
http://seclists.org/fulldisclosure/2012/May/43

Deep Links
Links available to Secunia VIM customers