PT-2015-7754 · Synnefo · Synnefo Ims

Aravind C Ajayan · Published 2015-12-15 · Updated 2018-10-09 · CVE-2015-8247

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Synnefo Internet Management Software (IMS) 2015

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the plan name parameter to the "packagehistory/listusagesdata" endpoint. This could potentially lead to unauthorized actions on the affected system.

Recommendations For Synnefo Internet Management Software (IMS) 2015, avoid using the plan name parameter in the "packagehistory/listusagesdata" endpoint until a fix is available. As a temporary workaround, consider restricting access to this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2015-8247

Affected Products

Synnefo Ims

References · 4

• 🔥 http://seclists.org/fulldisclosure/2015/Dec/54 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-8247 · Security Note
• http://packetstormsecurity.com/files/134797/Synnefo-Client-Cross-Site-Scripting.html · Note
• http://securityfocus.com/archive/1/537099/100/0/threaded · Note