Nessus Plugin #12301

Plugin Index

Note: This file has been created from a downloaded version of the Nessus Plugins from http://www.nessus.org/. Therefore, the information here can be outdated.

Citrix Web Interface XSS

Family:

CGI abuses : XSS

Category:

infos

Copyright:

This script is Copyright (C) 2003 Michael J. Richardson

Summary:

Checks for Citrix Web Interface Cross Site Scripting Vulnerability

Version:

$Revision: 1.2 $

Cve_id:

-

Bugtraq_id:

8939

Xrefs:

OSVDB:2762

Description:

The remote server is running a Citrix Web Interface server that is vulnerable to cross site scripting. When a user fails to authenticate, the Citrix Web Interface includes the error message text in the URL. The error message can be tampered with to perform a XSS attack.

See also:
- http://support.citrix.com/kb/entry.jspa?entryID=3211 (Citrix Document ID: CTX102686)
- https://www.cert.org/archive/pdf/cross_site_scripting.pdf
- http://www.security-corporation.com/articles-20031102-001.html

Solution : Upgrade to Citrix Web Interface 2.1 or newer.
Risk factor : Medium