PT-2014-5715 · Algosec · Algosec Fireflow
Published
2014-06-16
·
Updated
2015-12-04
·
CVE-2014-4164
CVSS v2.0
4.3
Medium
| Vector | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
AlgoSec FireFlow version 6.3-b230
Description
A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via a user signature to "SelfService/Prefs.html". This could potentially lead to unauthorized actions on the affected system.
Recommendations
For AlgoSec FireFlow version 6.3-b230, consider disabling access to the "SelfService/Prefs.html" endpoint until a patch is available to prevent exploitation of the XSS vulnerability.
Exploit
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Algosec Fireflow