A vulnerability has been detected in Sun's java system communications express web-based communications and collaboration application.
Detected by Core Security Technologies, the vulnerability exists in a remote access element of Sun's Java Communications Suite, which if leveraged, could allow attackers to target users of the application through exploitation of cross-site scripting (XSS) bugs.
The first XSS vulnerability, which is resident in the personal address book's 'add contact' functionality, concerns the affected URL that is originally accessed thru a post request, and the flaw can be exploited both with a get and with a post request.
CoreLabs immediately alerted the Sun security coordination team to the vulnerabilities, and the two companies have since synchronised efforts to ensure that patches could be created and made available to protect users of the program.
Ivan Arce, CTO of Core Security Technologies, said: “XSS bugs are popular among attackers attempting to coax web applications into providing control of end users' web browsers to carry out a wide range of malicious schemes. It is very important that organisations take the necessary steps to ensure that the applications they build or licence from third parties are not susceptible to these types of exploits.”
See original article on scmagazineus.com