Joomla! Incapsula Component "token" Cross-Site Scripting Vulnerability

SECUNIA ADVISORY ID:
SA51759

VERIFY ADVISORY:
Secunia.com
http://secunia.com/advisories/51759/
Customer Area (Credentials Required)
https://ca.secunia.com/?page=viewadvisory&vuln_id=51759

RELEASE DATE:
2013-01-11
DESCRIPTION:
Gjoko Krstic has reported a vulnerability in the Incapsula component
for Joomla!, which can be exploited by malicious people to conduct
cross-site scripting attacks.

Input passed via the "token" GET parameter to
/administrator/components/com_incapsula/assets/tips/en/Performance.php
is not properly sanitised before being returned to the user. This can
be exploited to execute arbitrary HTML and script code in a user's
browser session in context of an affected site.

The vulnerability is reported in version 1.4.6_b. Other versions may
be affected.

SOLUTION:
Update to version 1.4.8.

PROVIDED AND/OR DISCOVERED BY:
Gjoko Krstic (LiquidWorm)

ORIGINAL ADVISORY:
Zero Science:
http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5121.php