Netsweeper 4.0.3 - Cross Site Scripting Injection Vulnerability

+---------------------------------------------------+
+ Netsweeper 4.0.3 - Cross Site Scripting Injection +
+---------------------------------------------------+
Affected Product: Netsweeper
Vendor Homepage	: www.netsweeper.com
Version 	: 4.0.3 (and probably other versions)
Discovered by   : Anastasios Monachos (secuid0) - [anastasiosm (at) gmail (dot) com]
Patched      	: Yes
CVE		: CVE-2014-9608

+---------------------+
+ Product Description +
+---------------------+
Netsweeper is a software solution specialized in content filtering.

+----------------------+
+ Exploitation Details +
+----------------------+
One parameter was identified being vulnerable to XSS injection attacks, details are provided below:

URL Path: http://netsweeper/webadmin/policy/group_table_ajax.php/[XSS]

+----------+
+ Solution +
+----------+
Upgrade to latest version.

+---------------------+
+ Disclosure Timeline +
+---------------------+
24-Nov-2014: Initial Communication
03-Dec-2014: Netsweeper responded
03-Dec-2014: Shared full details to replicate the issue
10-Dec-2014: Netsweeper fixed the issue in releases 3.1.10, 4.0.9, 4.1.2
17-Dec-2014: New releases 3.1.10, 4.0.9, 4.1.2 made available to the public
18-Dec-2014: Confirm fix
17-Jan-2015: CVE assigned CVE-2014-9608
11-Aug-2015: Public disclosure

#  0day.today [2018-03-19]  #