PT-2021-20832 · Netscout · Netscout Ngeniusone

Published 2021-09-30 · Updated 2021-10-04 · CVE-2021-35200

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: NETSCOUT nGeniusONE version 6.3.0 build 1196

Description: The issue allows high-privileged users to achieve Stored Cross-Site Scripting (XSS) in FDSQueryService. This means that an attacker with high privileges could potentially inject malicious scripts into the system, which would then be executed by other users, allowing the attacker to steal user sessions, deface websites, or redirect the user to malicious sites.

Recommendations: For NETSCOUT nGeniusONE version 6.3.0 build 1196, consider restricting access to the FDSQueryService to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit the privileges of users who have access to this service to reduce the potential impact of a Stored Cross-Site Scripting attack. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-35200

Affected Products

Netscout Ngeniusone

References · 4

• https://osv.dev/vulnerability/CVE-2021-35200 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-35200 · Security Note
• https://netscout.com/securityadvisories · Vendor Advisory
• https://t.me/cibsecurity/29750 · Telegram Post