CVE-2013-2504

Name of the Vulnerable Software and Affected Versions Matrix42 Service Store version 5.3 SP3 (aka 5.33.946.0)

Description A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the query string in the SPS/Portal/default.aspx page of the Service Desk component.

Recommendations For version 5.3 SP3 (aka 5.33.946.0), consider restricting access to the SPS/Portal/default.aspx page until a fix is available, and avoid using user-supplied input in the query string to minimize the risk of exploitation.