A vulnerability has been identified in IBM ENOVIA SmarTeam, which could be exploited by attackers to execute arbitrary scripting code. This issue is caused by an input validation error in the "WebEditor/Authentication/LoginPage.aspx" script when processing the "errMsg" parameter, which could be exploited by attackers to cause arbitrary scripting code to be executed by the user's browser in the security context of an affected site.

Affected Products

IBM ENOVIA SmarTeam V5

Solution

VUPEN Security is not aware of any vendor-supplied patch.

References

http://www.vupen.com/english/advisories/2010/0598
http://seclists.org/bugtraq/2010/Mar/76

Credits

Vulnerability reported by Yaniv Miron (Lament).

Changelog

2010-03-12 : Initial release

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.