Netikus EventSentry CVE-2016-5077 HTML Injection Vulnerability

Bugtraq ID:	98718
Class:	Input Validation Error
CVE:	CVE-2016-5077
Remote:	Yes
Local:	No
Published:	Apr 14 2017 12:00AM
Updated:	Apr 14 2017 12:00AM
Credit:	Deral Heiland and Matthew Kienow.
Vulnerable:	Netikus EventSentry 3.2.1.8 Netikus EventSentry 3.2.1.30 Netikus EventSentry 3.2.1.22
Not Vulnerable:	Netikus EventSentry 3.2.1.44

Netikus EventSentry CVE-2016-5077 HTML Injection Vulnerability

Netikus EventSentry is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.

Successful exploits will result in the execution of arbitrary attacker-supplied HTML and script code in the context of the affected application, potentially allowing the attacker to steal cookie-based authentication credentials or control how the page is rendered to the user. Other attacks are also possible.

Versions prior to EventSentry 3.2.1.44 are vulnerable.

Netikus EventSentry CVE-2016-5077 HTML Injection Vulnerability

An attacker can exploit this issue using a web browser.

Netikus EventSentry CVE-2016-5077 HTML Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Netikus EventSentry CVE-2016-5077 HTML Injection Vulnerability

References:

• EventSentry Homepage (EventSentry)
  
• Multiple Disclosures for Multiple Network Management Systems, Part 2 (rapid7.com)