bugtraq - Huawei E587 3G Mobile Hotspot Web UI Cross Site Scripting vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <51E3CA88.6030706@gmail.com>
Date: Mon, 15 Jul 2013 12:10:16 +0200
From: Frédéric Basse <basse.frederic@...il.com>
To: bugtraq@...urityfocus.com
Subject: Huawei E587 3G Mobile Hotspot Web UI Cross Site Scripting vulnerability


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Huawei E587 3G Mobile Hotspot Web UI Cross Site Scripting vulnerability
________________________________________________________________________
Summary:
Huawei E587 3G Mobile Hotspot, version 11.203.27, is prone to a XSS
vulnerability in the Web UI.

A specialy crafted SMS can bypass the function used to sanitize incoming
 SMS messages.
________________________________________________________________________
Details:

________________________________________________________________________
CVSS Version 2 Metrics:
Access Vector: Network exploitable
Access Complexity: Low
Authentication: Not required to exploit
Confidentiality Impact: None
Integrity Impact: Partial
Availability Impact: None
________________________________________________________________________
Disclosure Timeline:
2013-03-18 Vendor notified
2013-07-15 Public advisory
________________________________________________________________________
References:
http://www.huawei.com/en/security/psirt/
________________________________________________________________________
Frédéric Basse
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEcBAEBAgAGBQJR48qIAAoJENQ4kG3hg80AgyoIAI1bZC6gBiob30teyqUNnFct
ppgDCCoS4EadET2CFk3871qHQiHU5dxgYelk3K5XDO6H9ghh4BDkrxNB2/rDWwgu
0jNV1Fl9DTbTa1nrKCDXuexD6cEEvCPq9AkEMUeIVpm6LzgguWZzbvd5cfx9zMYY
lyUGkqUE17fGcQKLjHxb//9aiv8CDO7vdsSS2NrpeGZmzNnP7trLpcLVwJ1bM72R
0XSHM+RBFPh43/YYOhmVmMWEusMIzC1JNMRGybd4jYTg4dxmBUb+2joMnI2ZMPHM
3963oSvU/sLYGtoTD4j8hFSoG151E9soIyJ5q6HMTP0hFEtG5tMHKbVrn9jf3tE=
=8k04
-----END PGP SIGNATURE-----