PT-2015-5724 · Huawei · Seq Analyst

Uğur Cihan Koç · Published 2015-05-08 · Updated 2015-05-11 · CVE-2015-2347

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Huawei SEQ Analyst versions prior to V200R002C03LG0001CP0022

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the command XML element in the req parameter to "flexdata.action" in various directories, including "common/", "monitor/", or "psnpm/", or the module XML element in the req parameter to "flexdata.action" in "monitor/".

Recommendations For versions prior to V200R002C03LG0001CP0022, update to V200R002C03LG0001CP0022 or later to resolve the issue. As a temporary workaround, consider restricting access to the "flexdata.action" endpoint in the affected directories until a patch is applied. Avoid using the req parameter with untrusted input in the "flexdata.action" endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-2347

Affected Products

Seq Analyst

References · 5

• 🔥 http://seclists.org/fulldisclosure/2015/Apr/43 · Exploit
• 🔥 http://packetstormsecurity.com/files/131460/Huawei-SEQ-Analyst-Cross-Site-Scripting.html · Exploit
• 🔥 https://drive.google.com/folderview?id=0B-LWHbwdK3P9fnBlLWZqWlZqNnB0b2xHWFpYUWt3bmY3Y0lPUHVLNm9VTUlFcWhYTHlZSUU&usp=sharing · Exploit
• http://huawei.com/en/security/psirt/security-bulletins/security-notices/hw-424267.htm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-2347 · Security Note