CVE-2015-7370

Múltiples vulnerabilidades de XSS en open-flash-chart.swf en Open Flash Chart 2, como es utilizado en el plugin VideoAds en Revive Adserver en versiones anteriores a 3.2.2 y CA Release Automation (anteriormente LISA Release Automation) 5.0.2 en versiones anteriores a 5.0.2-227, 5.5.1 en versiones anteriores a 5.5.1-1616, 5.5.2 en versiones anteriores a 5.5.2-434 y 6.1.0 en versiones anteriores a 6.1.0-1026, permite a atacantes remotos inyectar secuencias de comandos web HTML arbitrarios a través del parámetro (1) id o (2) data-file.

CA Technologies Support is alerting customers to multiple potential risks with CA Release Automation. Three vulnerabilities exist that can allow a remote attacker to potentially gain sensitive information or cause a denial of service condition. CA has fixes available. The first vulnerability occurs due to the inclusion of a vulnerable 3rd party component, Open Flash Chart. A remote attacker can conduct cross-site scripting attacks The second vulnerability occurs due to insufficient verification of requests to the web server, which can lead to limited XML external entity attacks. An authenticated attacker in the local network can potentially gain sensitive information or cause a denial of service condition. The third vulnerability occurs due to insufficient verification of requests to the web interface, which leads to multiple reflected cross-site scripting vulnerabilities and one stored cross-site scripting vulnerability.