Secunia

A vulnerability has been identified in Zeus Server web admin, which allows malicious people to conduct Cross Site Scripting attacks.

This is possible because a script doesn't validate user input properly:
http://[victim]:9090/apps/web/vs_diag.cgi?servers=<script>alert(document.cookie)</script>

This can only be conducted against users, who are already logged in.

Version 4.2r2 has been reported to be vulnerable.

Solution
Update to version 4.2r3 or later.

Provided and/or discovered by
Hugo "Vázquez" "Caramés"

Changelog
Further details available in Customer Area

Original Advisory
http://support.zeus.com/security/cssadmin2.html

Deep Links
Links available in Customer Area