Vulners
Lucene search
SonicWALL GMS 7.2 Build 7221.1701 Cross Site Scripting
`I. VULNERABILITY
-------------------------
Reflected XSS vulnerabilities in DELL SonicWALL GMS 7.2 Build: 7221.1701
II. BACKGROUND
-------------------------
Dell® SonicWALL® provides intelligent network security and data protection
solutions that enable customers and partners to dynamically secure,
control, and scale their global networks.
III. DESCRIPTION
-------------------------
Has been detected a Reflected XSS vulnerability in DELL SonicWALL GMS.
The code injection is done through the parameter "node_id" in the page
“/sgms/panelManager?level=1&typeOfUnits=2&node_name=GlobalView&node_id=(HERE
XSS)”
IV. PROOF OF CONCEPT
-------------------------
The application does not validate the parameter “node_ID” correctly.
https://10.200.210.222:8443/sgms/panelManager?level=1&typeOfUnits=2&node_name=GlobalView&node_id=aaaaaaa'</script><body
onload=alert(document.cookie)>&panelidz=0,4#tabs-4
V. BUSINESS IMPACT
-------------------------
An attacker can execute arbitrary HTML or script code in a targeted
user's browser, that allows the execution of arbitrary HTML/script code to
be executed in the context of the victim user's browser allowing Cookie
Theft/Session Hijacking, thus enabling full access the box.
VI. SYSTEMS AFFECTED
-------------------------
Tested DELL SonicWALL Analyzer v7.2 (build 7220.1700)
VII. SOLUTION
-------------------------
https://support.software.dell.com/product-notification/128245
By William Costa
[email protected]
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
22 Jul 2014 00:00Current
0.3Low risk
Vulners AI Score0.3