Re: KF Web Server 3.1.0 admin console XSS
Thank you Shay for finding this issue and taking the time to test our product.
We consider this issue to be of minor severity as it does not affect web sites
hosted by the web server.
The problem is not in the web server itself but in the admin script hosted by
the server. In order to access this script the attacker would need to be logged
onto the server locally and have the admin password. With that level of access
they would already have complete control of the web server configuration, in
effect root access, so there would be no need to use this technique.
We do take this issue and all security issues seriously and have issued a patch
which can be downloaded from our web site.
http://www.keyfocus.net/kfws/download/