ManageEngine EventLog Analyzer and Firewall Analyzer Cross Site Scripting Vulnerability
BID:74262
Info
ManageEngine EventLog Analyzer and Firewall Analyzer Cross Site Scripting Vulnerability
| Bugtraq ID: | 74262 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 21 2015 12:00AM |
| Updated: | Apr 21 2015 12:00AM |
| Credit: | Kapil Kulkarni |
| Vulnerable: |
ManageEngine Firewall Analyzer 8.3 Build 8300 ManageEngine Eventlog Analyzer 10 Build 10003 |
| Not Vulnerable: | |
Discussion
ManageEngine EventLog Analyzer and Firewall Analyzer Cross Site Scripting Vulnerability
ManageEngine EventLog Analyzer and Firewall Analyzer are prone to a cross-site-scripting vulnerability because they fail to properly sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
The following products are affected:
EventLog Analyzer 10 Build 10003
Firewall Analyzer 8.3 Build 8300
ManageEngine EventLog Analyzer and Firewall Analyzer are prone to a cross-site-scripting vulnerability because they fail to properly sanitize user-supplied input.
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
The following products are affected:
EventLog Analyzer 10 Build 10003
Firewall Analyzer 8.3 Build 8300
Exploit / POC
ManageEngine EventLog Analyzer and Firewall Analyzer Cross Site Scripting Vulnerability
Attackers can exploit these issues by enticing an unsuspecting user to follow a malicious URI.
Attackers can exploit these issues by enticing an unsuspecting user to follow a malicious URI.
Solution / Fix
ManageEngine EventLog Analyzer and Firewall Analyzer Cross Site Scripting Vulnerability
Solution:
Reportedly, the issue is fixed; however, Symantec has not confirmed this. Please contact the vendor for more information.
Solution:
Reportedly, the issue is fixed; however, Symantec has not confirmed this. Please contact the vendor for more information.
References
ManageEngine EventLog Analyzer and Firewall Analyzer Cross Site Scripting Vulnerability
References:
References:
- Manage Engine Homepage (ManageEngine)
- Reflected XSS Vulnerability In Manage Engine Event Log Analyzer (Kapil Kulkarni)
- Reflected XSS Vulnerability In Manage Engine Firewall Analyzer (Kapil Kulkarni)