Tenable SecurityCenter 'devform.php' Cross Site Scripting Vulnerability

Bugtraq ID:	62609
Class:	Input Validation Error
CVE:	CVE-2013-5911
Remote:	Yes
Local:	No
Published:	Sep 23 2013 12:00AM
Updated:	Mar 19 2015 08:46AM
Credit:	Jamieson O'Reilly
Vulnerable:
Not Vulnerable:

Tenable SecurityCenter 'devform.php' Cross Site Scripting Vulnerability

Tenable SecurityCenter is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

SecurityCenter 4.6 and 4.7 are vulnerable.

Tenable SecurityCenter 'devform.php' Cross Site Scripting Vulnerability

An attacker can exploit the issue by enticing an unsuspecting user to visit a specially crafted URL.

Tenable SecurityCenter 'devform.php' Cross Site Scripting Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Tenable SecurityCenter 'devform.php' Cross Site Scripting Vulnerability

References:

• Tenable Network Security Homepage (Tenable Network Security)
  
• Advisory - Cross-Site Scripting Vulnerability in SecurityCenter (Tenable Network Security)