Dell SonicWall SonicOS NSA CVE-2018-5280 HTML Injection Vulnerability

Bugtraq ID:	102438
Class:	Input Validation Error
CVE:	CVE-2018-5280
Remote:	Yes
Local:	No
Published:	Jan 08 2018 12:00AM
Updated:	Jan 08 2018 12:00AM
Credit:	Benjamin K.M.
Vulnerable:	Dell SonicWALL SonicOS 0 Dell SonicWALL NSA 6600 Dell SonicWALL NSA 5600 Dell SonicWALL NSA 4600 Dell SonicWALL NSA 3600 Dell SonicWALL NSA 2600 Dell SonicWALL NSA 250M
Not Vulnerable:

Dell SonicWall SonicOS NSA CVE-2018-5280 HTML Injection Vulnerability

Dell SonicWall SonicOS NSA is prone to HTML-Injection vulnerability.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Dell SonicWall SonicOS NSA CVE-2018-5280 HTML Injection Vulnerability

The researcher who discovered this issue has created a proof-of-concept. Please see the references for more information.

Dell SonicWall SonicOS NSA CVE-2018-5280 HTML Injection Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Dell SonicWall SonicOS NSA CVE-2018-5280 HTML Injection Vulnerability

References:

• Dell SonicWALL SonicOS HomePage (SonicWaLL)
  
• SonicWall SonicOS NSA - Multiple Web Vulnerabilities (Vulnerability Laboratory)