Description
A cross-site scripting vulnerability in Caucho Technology Resin before 1.2.4 allows a malicious webmaster to embed Javascript in a hyperlink that ends in a .jsp extension, which causes an error message that does not properly quote the Javascript.
References
- java-servlet-crosssite-scripting(6793) vdb-entry
- 20010702 Multiple Vendor Java Servlet Container Cross-Site Scripting Vulnerability mailing-list
- VU#981651 third-party-advisory
- 1890 vdb-entry
- 2981 vdb-entry
- http://www.caucho.com/products/resin/changes.xtp