medium4.3Public exploit code
CVE-2015-2223
Multiple cross-site scripting (XSS) vulnerabilities in the web-based console management interface in Palo Alto Networks Traps (formerly Cyvera Endpoint Protect…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Palo Alto Traps Server 3.1.2.1546 - Persistent Cross-Site Scripting2015-03-31 · webapps · windows
Impact
Multiple cross-site scripting (XSS) vulnerabilities in the web-based console management interface in Palo Alto Networks Traps (formerly Cyvera Endpoint Protection) 3.1.2.1546 allow remote attackers to inject arbitrary web script or HTML via the (1) Arguments, (2) FileName, or (3) URL parameter in a SOAP request.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Palo Alto Networks | Traps | Version 3.1.2.1546 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/131182/Palo-Alto-Traps-Server-3.1.2.1546-Cross-Site-Scripting.html
- http://www.securityfocus.com/archive/1/535113/100/0/threaded
- http://www.securityfocus.com/bid/73704
- https://security.paloaltonetworks.com/CVE-2015-2223
- http://packetstormsecurity.com/files/131182/Palo-Alto-Traps-Server-3.1.2.1546-Cross-Site-Scripting.html
- http://www.securityfocus.com/archive/1/535113/100/0/threaded
- http://www.securityfocus.com/bid/73704
- https://security.paloaltonetworks.com/CVE-2015-2223