PT-2017-13581 · Watchguard · Watchguard Fireware

Published 2017-09-20 · Updated 2017-10-04 · CVE-2017-14615

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WatchGuard Fireware versions prior to 12.0

Description A security issue was discovered in the XML-RPC interface of WatchGuard Fireware. When a failed login attempt is made to the login endpoint, if JavaScript code is embedded as the value of the user element, the code will be rendered in the context of any logged-in user visiting the "Traffic Monitor" sections "Events" and "All" in the Web UI. This results in no further events being visible in the Traffic Monitor until the device is restarted.

Recommendations For versions prior to 12.0, update to version 12.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the "Traffic Monitor" sections until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-14615

Affected Products

Watchguard Fireware

References · 5

• 🔥 http://seclists.org/bugtraq/2017/Sep/22 · Exploit
• 🔥 https://sidertia.com/Home/Community/Blog/2017/09/18/Fixed-Fireware-XXE-DOS-and-stored-XSS-vulnerabilities-discovered-by-Sidertia · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-14615 · Security Note
• https://watchguardsupport.secure.force.com/publicKB?type=KBSecurityIssues&SFDCID=kA62A0000000L0HSAU&lang=en_US · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-14615 · Vendor Advisory