PT-2014-4942 · Dell · Sonicwall Email Security
Benjamin Kunz Mejri
·
Publicado
2014-04-17
·
Atualizado
2018-10-09
·
CVE-2014-2879
CVSS v2.0
4.3
Média
| Vetor | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Dell SonicWALL Email Security versions 7.4.5 and earlier
Description
The issue allows remote authenticated administrators to inject arbitrary web script or HTML. This can be achieved via the
uploadPatch parameter to the "System/Advanced" page (settings advanced.html) or the uploadLicenses parameter in the "License management" (settings upload dlicense.html) page.Recommendations
For versions 7.4.5 and earlier, consider disabling access to the settings advanced.html and settings upload dlicense.html pages until a fix is available. Restrict the use of the
uploadPatch and uploadLicenses parameters to minimize the risk of exploitation.Exploit
Correção
XSS
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Sonicwall Email Security