Emerson Network Power Liebert Challenger 5.1E0.5 Cross Site Scripting Vulnerability

I. VULNERABILITY
    -------------------------
    httpGetSet/httpGet.htm on
    Emerson Network Power Liebert Challenger 5.1E0.5 devices allows XSS via the statusstr parameter.
     
    II. CVE REFERENCE
    -------------------------
    CVE-2019-12167
     
    III. VENDOR
    -------------------------
    Emerson Network Power
     
    IV. TIMELINE
    -------------------------
    13/05/2019 Vulnerability discovered
     
    V. CREDIT
    -------------------------
    Kubilay Onur Gungor from Cyber Struggle
     
    VI. DESCRIPTION
    -------------------------
    Cross Site Scripting (XSS) allows clients to inject scripts into a request and
    have the server return the script to the client in the response. This occurs
    because the application is taking untrusted data and reusing it
    without performing any validation or sanitisation.
    A remote user can conduct cross-site scripting attacks.
     
    Affected Component:
    Path(inurl): /httpGetSet/httpGet.htm?
    Parameter: statusstr
     
    VII. SOLUTION
    -------------------------
    Update to lastest version.
 
#  0day.today [2019-05-21]  #