A cross-site scripting (XSS) vulnerability in the Sun Java System Access Manager Cross-Domain Controller (CDC) may allow an unprivileged remote user to inject code into web pages served by the Access Manager CDC which can result in various impacts including the theft of sensitive information such as cookie information, access to user credentials, or the hijacking of sessions.

The Cross-Domain Controller (CDC) is a servlet that communicates with policy agents outside its own domain, and then checks for a user's Single Sign-On (SSO) information.

Permalink |