CVE-2016-8581: XSS
Published Oct 28, 2016
·Updated
A persistent XSS vulnerability exists in the User-Agent header of the login process of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to steal session IDs of logged in users when the current sessions are viewed by an administrator.
Affected Software
2 affected components
AlienVault Open Source Security Information And Event Management<=5.3.1
AlienVault Unified Security Management<=5.3.1
Event History
Oct 28, 2016
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-8581?
CVE-2016-8581 is considered a medium severity vulnerability as it allows for session ID theft through persistent XSS.
2
How do I fix CVE-2016-8581?
To fix CVE-2016-8581, upgrade AlienVault OSSIM and USM to version 5.3.2 or later.
3
What can an attacker do with CVE-2016-8581?
An attacker can exploit CVE-2016-8581 to steal session IDs of logged-in users by manipulating the User-Agent header.
4
Which versions of AlienVault are affected by CVE-2016-8581?
CVE-2016-8581 affects AlienVault OSSIM and USM versions prior to 5.3.2.
5
Is CVE-2016-8581 a type of cross-site scripting vulnerability?
Yes, CVE-2016-8581 is a persistent cross-site scripting (XSS) vulnerability.