Vulnerable Systems:
* CA eHealth Performance Manager 6.0.x
* CA eHealth Performance Manager 6.1.x
* CA eHealth Performance Manager 6.2.x
A cross-site scripting vulnerability exists that can allow a remote attacker to potentially gain sensitive information. CA has provided guidance to remediate the vulnerability.
The vulnerability, CVE-2010-0640, is due to insufficient validation of certain characters in web interface requests. An attacker, who can have an unsuspecting user follow a malicious URL, can conduct cross-site scripting attacks.
Workaround:
To remediate the vulnerability, enable the "Scan user input for potentially malicious HTML content" configuration setting as follows:
1) Log into the eHealth Web Interface as the "Admin" user
2) Navigate to the "Administration" tab
3) Select the "Site Configuration" link
4) Locate the "Scan user input for potentially malicious HTML content" option and modify its value from "No" to "Yes"
5) Select "Save" to implement the new configuration setting
