CloudView NMS CVE-2016-5075 HTML Injection Vulnerability

Bugtraq ID:	98721
Class:	Input Validation Error
CVE:	CVE-2016-5075
Remote:	Yes
Local:	No
Published:	Apr 09 2017 12:00AM
Updated:	Apr 09 2017 12:00AM
Credit:	Deral Heiland and Matthew Kienow.
Vulnerable:	cloudviewnms CloudView NMS 2.09b
Not Vulnerable:	cloudviewnms CloudView NMS 2.10a

CloudView NMS CVE-2016-5075 HTML Injection Vulnerability

CloudView NMS is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.

Successful exploits will result in the execution of arbitrary attacker-supplied HTML and script code in the context of the affected application, potentially allowing the attacker to steal cookie-based authentication credentials or control how the page is rendered to the user. Other attacks are also possible.

Versions prior to CloudView NMS 2.10a are vulnerable.

CloudView NMS CVE-2016-5075 HTML Injection Vulnerability

The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information.

CloudView NMS CVE-2016-5075 HTML Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

CloudView NMS CVE-2016-5075 HTML Injection Vulnerability

References:

• CloudView NMS Homepage (CloudView NMS)
  
• Multiple Disclosures for Multiple Network Management Systems, Part 2 (rapid7.com)