Sophos Cyberoam NG Series Cross Site Scripting
Posted by deepcore on April 5, 2016 – 9:37 am
Multiple reflected cross site scripting issues were discovered in Cyberoam NG appliances. Input passed via the ‘ipFamily’, ‘applicationname’ and ‘username’ GET parameters to LiveConnections.jsp and LiveConnectionDetail.jsp is not properly sanitized before being returned to the user. Adding arbitrary ‘X-Forwarded-For’ HTTP header to a request makes the appliance also prone to a XSS issue. This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an affected site.
Post a reply
You must be logged in to post a comment.