Arbor Networks Peakflow X Multiple Cross Site Scripting and Security Bypass Vulnerabilities

Bugtraq ID:	63560
Class:	Input Validation Error
CVE:	CVE-2011-4636 CVE-2011-4637
Remote:	Yes
Local:	No
Published:	Oct 31 2013 12:00AM
Updated:	Mar 19 2015 09:13AM
Credit:	Maxim Tsoy and Dmitriy Gutsko of Positive Technologies.
Vulnerable:
Not Vulnerable:

Arbor Networks Peakflow X Multiple Cross Site Scripting and Security Bypass Vulnerabilities

Arbor Networks Peakflow X is prone to multiple cross-site scripting vulnerabilities and a security-bypass vulnerability.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials or bypass security restrictions to perform unauthorized actions; this may aid in launching further attacks.

Arbor Networks Peakflow X 4.2.3 is vulnerable; other versions may also be affected.

Arbor Networks Peakflow X Multiple Cross Site Scripting and Security Bypass Vulnerabilities

Attackers can exploit security-bypass issue using a browser. To exploit cross-site scripting issues, an attacker must entice an unsuspecting user to follow a malicious URI.

Arbor Networks Peakflow X Multiple Cross Site Scripting and Security Bypass Vulnerabilities

Solution:
Reportedly these issues are fixed, however Symantec has not confirmed this. Please contact the vendor for more information.

Arbor Networks Peakflow X Multiple Cross Site Scripting and Security Bypass Vulnerabilities

References:

• Arbor Networks Homepage (Arbor Networks)