Dell SonicWALL Network Security Appliance NSA 6600 suffers from a reflective cross site scripting vulnerability. Versions affected include NSA 6600 running SonicOS Enhanced 220.127.116.11-31n, WXA 4000 running 18.104.22.168-07, and SafeMode 22.214.171.124.
i>>? Dell SonicWALL Network Security Appliance NSA 6600 Reflected XSS Vendor: Dell Inc. Product web page: https://www.sonicwall.com/products/sonicwall-nsa/ Affected version: NSA 6600 running SonicOS Enhanced 126.96.36.199-31n WXA 4000 running 188.8.131.52-07 SafeMode 184.108.40.206 Summary: Uncompromising security and performance for emerging large organizations. The NSA 6600 network security appliance delivers best-in-class protection, speed and scalability with 12 Gbps throughput and up to 6000 VPN clients. Desc: SonicWALL NSA suffers from a XSS issue due to a failure to properly sanitize user-supplied input to the 'curUserName' GET parameter in the 'appFirewallSummary.html' script. Attackers can exploit this weakness to execute arbitrary HTML and script code in a user's browser session. Tested on: SonicWALL MySQL/5.0.96-community-nt Apache-Coyote/1.1 Apache Tomcat 6.0.41 Vulnerability discovered by Gjoko 'LiquidWorm' Krstic @zeroscience Advisory ID: ZSL-2016-5391 Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5391.php 26.01.2016 -- https://127.0.0.1/appFirewallSummary.html?curSrcAddrString=&curTSAIdNum=0&curUserName=test";alert('XSS')// # 0day.today [2018-04-08] #