PT-2015-5724 · Huawei · Seq Analyst

Uğur Cihan Koç · Publicado 2015-05-08 · Atualizado 2015-05-11 · CVE-2015-2347

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Huawei SEQ Analyst versions prior to V200R002C03LG0001CP0022

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the command XML element in the req parameter to "flexdata.action" in various directories, including "common/", "monitor/", or "psnpm/", or the module XML element in the req parameter to "flexdata.action" in "monitor/".

Recommendations For versions prior to V200R002C03LG0001CP0022, update to V200R002C03LG0001CP0022 or later to resolve the issue. As a temporary workaround, consider restricting access to the "flexdata.action" endpoint in the affected directories until a patch is applied. Avoid using the req parameter with untrusted input in the "flexdata.action" endpoint until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2015-2347

Produtos afetados

Seq Analyst

Referências · 5

• 🔥 http://seclists.org/fulldisclosure/2015/Apr/43 · Exploit
• 🔥 http://packetstormsecurity.com/files/131460/Huawei-SEQ-Analyst-Cross-Site-Scripting.html · Exploit
• 🔥 https://drive.google.com/folderview?id=0B-LWHbwdK3P9fnBlLWZqWlZqNnB0b2xHWFpYUWt3bmY3Y0lPUHVLNm9VTUlFcWhYTHlZSUU&usp=sharing · Exploit
• http://huawei.com/en/security/psirt/security-bulletins/security-notices/hw-424267.htm · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-2347 · Nota de Segurança