CVE-2014-9606 Netsweeper 4.0.8 - Cross-Site Scripting

漏洞描述

Multiple cross-site scripting vulnerabilities in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allow remote attackers to inject arbitrary web script or HTML via the (1) server parameter to remotereporter/load_logfiles.php, (2) customctid parameter to webadmin/policy/category_table_ajax.php, (3) urllist parameter to webadmin/alert/alert.php, (4) QUERY_STRING to webadmin/ajaxfilemanager/ajax_get_file_listing.php, or (5) PATH_INFO to webadmin/policy/policy_table_ajax.php/.

影响产品

netsweeperNetsweeper查看产品 →

修复建议

建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。

参考链接

packetstormsecurity.comhttps://packetstormsecurity.com/files/download/133034/netsweeper-issues.tgz↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2014-9606↗packetstormsecurity.comhttp://packetstormsecurity.com/files/133034/Netsweeper-Bypass-XSS-Redirection-SQL-Injection-Execution.html↗github.comhttps://github.com/ARPSyndicate/kenzer-templates↗

漏洞与影响对象	风险等级	CVSS	EPSS	利用情报	披露时间
netsweeper_open_redirect Netsweeper 4.0.9 - Open Redirect Netsweeper	中危	6.1	—	PoCEXP	2023/10/20
CVE-2020-13167 Netsweeper <=6.4.3 - Python Code Injection Netsweeper	严重	9.8	93.1%	PoCEXP	2020/05/19
CVE-2014-9617 Netsweeper 3.0.6 - Open Redirection Netsweeper	中危	6.1	26.2%	PoCEXP	2020/02/19
CVE-2014-9615 Netsweeper 4.0.4 - Cross-Site Scripting Netsweeper	中危	6.1	9.4%	PoCEXP	2020/02/19
CVE-2014-9614 Netsweeper 4.0.5 - Default Weak Account Netsweeper	严重	9.8	69.5%	PoCEXP	2020/02/19
CVE-2014-9609 Netsweeper 4.0.8 - Directory Traversal Netsweeper	中危	5.3	33.8%	PoCEXP	2020/02/19

利用情报状态

漏洞描述

影响产品

修复建议

参考链接

同产品关联漏洞