Full Disclosure

CVE-2016-8581 – Alienvault OSSIM/USM Stored XSS Vulnerability

Leave a comment

Posted by Peter Lapp on Nov 01

Details
=======

Product: Alienvault OSSIM/USM
Vulnerability: Stored XSS
Author: Peter Lapp, lappsec () gmail com
CVE: CVE-2016-8581
CVSS: 3.5
Vulnerable Versions: <=5.3.1
Fixed Version: 5.3.2

Vulnerability Details
=====================

A stored XSS vulnerability exists in the User-Agent header of the
login process. It’s possible to inject a script into that header that
then gets executed when mousing over the User-Agent field in…

Leave a Reply