PT-2015-5865 · Websense · Websense V-Series+1

Cengiz Han Sahin · Published 2015-03-26 · Updated 2018-10-09 · CVE-2015-2747

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Websense Triton version 7.8.3 Websense V-Series version 7.7

Description The issue allows remote attackers to inject arbitrary web script or HTML via a crafted email or HTTP request, triggering a DLP Policy. This occurs due to multiple cross-site scripting (XSS) vulnerabilities in the data loss prevention (DLP) incident Forensics Preview.

Recommendations For Websense Triton version 7.8.3, update to a version that includes a fix for the XSS vulnerabilities in the DLP incident Forensics Preview. For Websense V-Series version 7.7, update to a version that includes a fix for the XSS vulnerabilities in the DLP incident Forensics Preview.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-2747

Affected Products

Websense Triton

Websense V-Series

References · 5

• 🔥 https://securify.nl/advisory/SFY20140904/websense_data_security_dlp_incident_forensics_preview_is_vulnerable_to_cross_site_scripting.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-2747 · Security Note
• http://seclists.org/fulldisclosure/2015/Mar/102 · Note
• http://securityfocus.com/archive/1/534908/100/0/threaded · Note
• http://packetstormsecurity.com/files/130897/Websense-Data-Security-DLP-Incident-Forensics-Preview-XSS.html · Note