PT-2013-6245 · Dell · Sonicwall Global Management System+2

Benjamin Kunz Mejri · Published 2013-12-09 · Updated 2018-03-12 · CVE-2013-7025

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Dell SonicWALL Global Management System (GMS), Analyzer, and UMA EM5000 version 7.1 SP1 before Hotfix 134235

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the ematStaticAlertTypes.jsp file within the Alert Settings section. These vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML via specific parameters. The vulnerable parameters are valfield 1 and value 1 in the createNewThreshold.jsp endpoint.

Recommendations For Dell SonicWALL Global Management System (GMS), Analyzer, and UMA EM5000 version 7.1 SP1 before Hotfix 134235, apply Hotfix 134235 to resolve the issue. As a temporary workaround, consider restricting access to the createNewThreshold.jsp endpoint and avoid using the valfield 1 and value 1 parameters until the hotfix is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2013-7025

Affected Products

Analyzer

Sonicwall Global Management System

Uma Em5000

References · 13

• 🔥 http://seclists.org/fulldisclosure/2013/Dec/32 · Exploit
• 🔥 http://securityfocus.com/bid/64103 · Exploit
• 🔥 http://vulnerability-lab.com/get_content.php?id=1099 · Exploit
• 🔥 https://exploit-db.com/exploits/30054 · Exploit
• 🔥 http://exploit-db.com/exploits/30054 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-7025 · Security Note
• http://sonicwall.com/us/shared/download/Support_Bulletin_GMS_Vulnerability_Hotfix_134235.pdf · Vendor Advisory
• http://securitytracker.com/id/1029433 · Note
• http://secunia.com/advisories/55923 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7025 · Note
• http://archives.neohapsis.com/archives/bugtraq/2013-12/0022.html · Note
• http://osvdb.org/100610 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/89462 · Note