medium6.1Public exploit code
CVE-2016-8581
A persistent XSS vulnerability exists in the User-Agent header of the login process of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to steal s…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Alienvault OSSIM/USM 5.3.1 - Persistent Cross-Site Scripting2016-11-02 · webapps · php · Verified
Impact
A persistent XSS vulnerability exists in the User-Agent header of the login process of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to steal session IDs of logged in users when the current sessions are viewed by an administrator.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Alienvault | Open Source Security Information And Event Management | through 5.3.1 |
| Alienvault | Unified Security Management | through 5.3.1 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.securityfocus.com/bid/93862
- https://www.alienvault.com/forums/discussion/7766/security-advisory-alienvault-5-3-2-address-70-vulnerabilities
- https://www.exploit-db.com/exploits/40683/
- http://www.securityfocus.com/bid/93862
- https://www.alienvault.com/forums/discussion/7766/security-advisory-alienvault-5-3-2-address-70-vulnerabilities
- https://www.exploit-db.com/exploits/40683/