Symantec Data Loss Prevention CVE-2014-9230 Multiple HTML Injection Vulnerabilities
BID:75288
Info
Symantec Data Loss Prevention CVE-2014-9230 Multiple HTML Injection Vulnerabilities
| Bugtraq ID: | 75288 |
| Class: | Input Validation Error |
| CVE: |
CVE-2014-9230 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 22 2015 12:00AM |
| Updated: | Jun 22 2015 12:00AM |
| Credit: | Mike Czumak (@SecuritySift) and Pieter Hiele |
| Vulnerable: |
Symantec Data Loss Prevention 12.5.1 Symantec Data Loss Prevention 12.5 |
| Not Vulnerable: |
Symantec Data Loss Prevention 12.5.2 Symantec Data Loss Prevention 14.0 |
Discussion
Symantec Data Loss Prevention CVE-2014-9230 Multiple HTML Injection Vulnerabilities
Symantec Data Loss Prevention is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input.
Attacker supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.
Symantec Data Loss Prevention 12.5.1 and prior are vulnerable.
Symantec Data Loss Prevention is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input.
Attacker supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.
Symantec Data Loss Prevention 12.5.1 and prior are vulnerable.
Exploit / POC
Symantec Data Loss Prevention CVE-2014-9230 Multiple HTML Injection Vulnerabilities
Attackers can use a browser to exploit these issues.
Attackers can use a browser to exploit these issues.