Dell SonicWall SonicOS NSA CVE-2018-5281 Multiple HTML Injection Vulnerabilities

Bugtraq ID:	102443
Class:	Input Validation Error
CVE:	CVE-2018-5281
Remote:	Yes
Local:	No
Published:	Jan 08 2018 12:00AM
Updated:	Jan 08 2018 12:00AM
Credit:	Benjamin K.M.
Vulnerable:	Dell SonicWALL SonicOS 0 Dell SonicWALL NSA 6600 Dell SonicWALL NSA 5600 Dell SonicWALL NSA 4600 Dell SonicWALL NSA 3600 Dell SonicWALL NSA 2600 Dell SonicWALL NSA 250M
Not Vulnerable:

Dell SonicWall SonicOS NSA CVE-2018-5281 Multiple HTML Injection Vulnerabilities

Dell SonicWall SonicOS NSA is prone to multiple HTML-Injection vulnerabilities .

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.


All versions of Dell SonicWall SonicOS are vulnerable.

Dell SonicWall SonicOS NSA CVE-2018-5281 Multiple HTML Injection Vulnerabilities

The researcher who discovered these issues has created a proof-of-concept. Please see the references for more information.

Dell SonicWall SonicOS NSA CVE-2018-5281 Multiple HTML Injection Vulnerabilities

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Dell SonicWall SonicOS NSA CVE-2018-5281 Multiple HTML Injection Vulnerabilities

References:

• sonicwall home page (sonicwall)
  
• SonicWall SonicOS NSA - Bypass & Persistent Vulnerability (Vulnerability Laboratory)