N/A

An XSS vulnerability allows remote attackers to execute arbitrary client side script on vulnerable installations of Sophos Cyberoam firewall devices with firmware through 10.6.4. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of a request to the "LiveConnectionDetail.jsp" application. GET parameters "applicationname" and "username" are improperly sanitized allowing an attacker to inject arbitrary JavaScript into the page. This can be abused by an attacker to perform a cross-site scripting attack on the user. A vulnerable URI is /corporate/webpages/trafficdiscovery/LiveConnectionDetail.jsp.

N/A

N/A

Sophos Cyberoam防火墙设备跨站脚本漏洞

Sophos Cyberoam firewall devices是英国Sophos公司的一套防火墙设备，它提供在线应用程序检测和控制、网页过滤、HTTPS检查、入侵防护等功能。 使用10.6.4及之前的版本固件的Sophos Cyberoam防火墙设备存在跨站脚本漏洞，该漏洞源于程序没有正确的过滤‘applicationname’和‘username’GET参数。远程攻击者可通过诱使用户访问恶意页面或打开恶意文件利用该漏洞向页面中注入任意的JavaScript。

N/A

跨站脚本