Macromedia Sitespring 1.2 - Default Error Page Cross-Site Scripting

Author: Peter GrÃ¼ndl
type: webapps
platform: jsp
port: 
date_added: 2002-07-17 
date_updated: 2012-09-30 
verified: 1 
codes: CVE-2002-1027;OSVDB-9231 
tags: 
aliases:  
screenshot_url:  
application_url:

source: https://www.securityfocus.com/bid/5249/info

Macromedia Sitespring is a J2EE-compliant product for managing website production. The Macromedia Sitespring server runs on Microsoft Windows operating systems.

A cross-site scripting issue has been reported in the default error page used by Sitespring. When an HTTP 500 error is returned, some user-supplied data is included in the generated HTML. Since this data isn't properly sanitized, an attacker may be able to include arbitrary HTML, including JavaScript.

http://server/error/500error.jsp?et=1<script>alert('KPMG')</script>