Allen Disk CVE-2017-9249 Cross-Site Scripting Vulnerability

Bugtraq ID:	98743
Class:	Input Validation Error
CVE:	CVE-2017-9249
Remote:	Yes
Local:	No
Published:	May 28 2017 12:00AM
Updated:	May 28 2017 12:00AM
Credit:	Viccon
Vulnerable:	s3131212 Allen Disk 1.6
Not Vulnerable:

Allen Disk CVE-2017-9249 Cross-Site Scripting Vulnerability

Allen Disk is prone to an cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Allen Disk CVE-2017-9249 Cross-Site Scripting Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

Allen Disk CVE-2017-9249 Cross-Site Scripting Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Allen Disk CVE-2017-9249 Cross-Site Scripting Vulnerability

References:

• Allendisk Homepage (Allendisk)
  
• XSS Vulnerability in /readfile.php #21 (Github)