Nokia Solutions And Networks Cross Site Scripting

`Document Title:  
==============  
Nokia Solutions and Networks @vantage - Multiple Reflected XSS  
  
Release Date:  
============  
9 Sep 2015  
  
Abstract Advisory Information:  
=============================  
Ugur Cihan Koc discovered twentySeven Reflected XSS  
vulnerability in Nokia NSN @vantage  
  
Vulnerability Disclosure Timeline:  
=================================  
24 July 2015 Bug reported to the vendor.  
28 July 2015 Asked about the case.  
8 Sep 2015 End of support for this product, reported by the vendor  
  
Discovery Status:  
================  
Published  
  
Affected Product(s):  
===================  
Nokia NSN @vantage  
  
Exploitation Technique:  
======================  
Local, Authenticated  
  
Severity Level:  
==============  
Medium  
  
Technical Details & Description:  
===============================  
Affected Path/Parameter[27] :  
  
/cftraces/filter/fl_copy.jsp  
idFilter  
nameFilter  
/cftraces/filter/fl_crea1.jsp  
flName  
/cftraces/process/pr_show_process.jsp  
serchStatus  
refreshTime  
serchNode  
/cftraces/session/se_crea.jsp  
MaxActivationTime  
NumberOfBytes  
NumberOfTracefiles  
SessionName  
serchSessionkind  
/cftraces/session/se_show.jsp  
serchSessionDescription  
/cftraces/session/tr_crea_filter.jsp  
serchApplication  
serchApplicationkind  
/cftraces/session/tr_create_tagg_para.jsp  
columKeyUnique  
columParameter  
componentName  
criteria1  
criteria2  
criteria3  
description  
filter  
id  
pathName  
tableName  
component  
/home/certificate_association.jsp  
userid  
  
Proof of Concept (PoC):  
======================  
Proof of Concept  
https://drive.google.com/open?id=0B-LWHbwdK3P9eTNKRkdDWGpkN2M  
  
Solution Fix & Patch:  
====================  
There aren't any fix for the issue. [End of Support]  
  
Security Risk:  
=============  
The risk of the vulnerability above estimated as medium.  
  
Credits & Authors:  
=================  
Ugur Cihan Koc(@_uceka_)  
Blog: www.uceka.com  
  
  
`