Openfiler Multiple Cross-Site Scripting and Information Disclosure Vulnerabilities

vendor:

Openfiler

by:

SecurityFocus

7,5

CVSS

HIGH

Cross-Site Scripting and Information Disclosure

79, 200

CWE

Product Name: Openfiler

Affected Version From: 2.3

Affected Version To: 2.99.2

Patch Exists: YES

Related CWE: N/A

CPE: //a:openfiler

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2012

Openfiler Multiple Cross-Site Scripting and Information Disclosure Vulnerabilities

Openfiler is prone to multiple cross-site scripting and information disclosure vulnerabilities. An attacker may leverage these issues to obtain potentially sensitive information and to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Mitigation:

Users should avoid following untrusted links and should never enter sensitive information unless they are certain that the destination is legitimate. Additionally, users should keep their system and applications updated with the latest patches.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/55500/info

Openfiler is prone to multiple cross-site scripting and information disclosure vulnerabilities.

An attacker may leverage these issues to obtain potentially sensitive information and to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Openfiler versions 2.3, 2.99.1 and 2.99.2 are vulnerable; other versions may also be affected. 

https://www.example.com/admin/system.html?step=2&device="><script>alert(document.cookie);</script><p+"

https://www.example.com/admin/volumes_iscsi_targets.html?targetName="><script>alert(document.cookie);</script><p+"

https://www.example.com/phpinfo.html

https://www.example.com/uptime.html