CVE-2017-8332 Cross-site scripting in n/a
Stored XSS in Securifi Almond routers allows attackers to execute arbitrary actions on the device via the web management interface.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-8332?
CVE-2017-8332 is a high-severity cross-site scripting vulnerability in n/a, published on 18 Jun 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An issue was discovered on Securifi Almond, Almond+, and Almond 2015 devices with firmware AL-R096. The device provides a user with the capability of blocking key words passing in the web traffic to prevent kids from watching content that might be deemed unsafe using the web management interface. It seems that the device does not implement any cross-site scripting protection mechanism which allows an attacker to trick a user who is logged in to the web management interface into executing a stored cross-site scripting payload on the user's browser and execute any action on the device provided by the web management interface.
Weakness: CWE-79
Which versions are affected by CVE-2017-8332?
It affects 3 products.
Products include Securifi Almond\+firmware, Securifi Almond 2015 Firmware, Securifi Almond Firmware.
How do I fix CVE-2017-8332?
No fix has been published for CVE-2017-8332 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2017-8332 being exploited?
There is no known exploitation of CVE-2017-8332 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-jx8c-58rg-6cqq.