lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 15 Apr 2015 11:01:20 +0300 From: Uğur Cihan KOÇ <u.cihan.koc@...il.com> To: fulldisclosure@...lists.org Subject: [FD] Huawei SEQ Analyst - Multiple Reflected Cross Site Scripting (XSS) #Document Title: ============ Huawei SEQ Analyst - Multiple Reflected Cross Site Scripting (XSS) #Release Date: =========== 15 Apr 2015 #CVE-ID: ======= CVE-2015-2347 #Product & Service Introduction: ======================= SEQ Analyst is a platform for business quality monitoring and management by individual user and multiple vendors in a quasi-realtime and retraceable manner More Details & Manual ; http://download.huawei.com/download/filedownload.do?modelID=bulletin&refID=IN0000056669,101 #Vulnerability Disclosure Timeline: ======================== 3 Mar 2015 Bug reported to the vendor. 6 Mar 2015 Vendor returned ; investigating 16 Mar 2015 Asked about the case. 16 Mar 2015 Vendor has validated the issue. 17 Mar 2015 There aren't any fix the issue. 18 Mar 2015 CVE number assigned 15 Apr 2015 Fixed #Affected Product(s): =============== Huawei Technologies Co. Ltd. Product: Huawei SEQ Analyst V200R002C03LG0001SPC100 (other versions may be vulnerable) #Exploitation Technique: ================= Local, Authenticated #Technical Details: ======================== Sample Payload : 261e9<script>alert(1)</script>57114 Affected Path/Parameter: [4 parameter] /common/flexdata.action [command XML parameter] /monitor/flexdata.action [command XML parameter] [module XML parameter] /psnpm/flexdata.action [command XML parameter] #Proof of Concept (PoC): ================== https://drive.google.com/folderview?id=0B-LWHbwdK3P9fnBlLWZqWlZqNnB0b2xHWFpYUWt3bmY3Y0lPUHVLNm9VTUlFcWhYTHlZSUU&usp=sharing #Solution Fix & Patch: ================ 15 Apr 2015 Fixed version --> SEQ Analyst V200R002C03LG0001CP0022 #Credits & Authors: ============== Ugur Cihan Koc @_uceka_ www.uceka.com _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Powered by blists - more mailing lists