CVE-2016-9834: XSS
An XSS vulnerability allows remote attackers to execute arbitrary client side script on vulnerable installations of Sophos Cyberoam firewall devices with firmware through 10.6.4. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of a request to the "LiveConnectionDetail.jsp" application. GET parameters "applicationname" and "username" are improperly sanitized allowing an attacker to inject arbitrary JavaScript into the page. This can be abused by an attacker to perform a cross-site scripting attack on the user. A vulnerable URI is /corporate/webpages/trafficdiscovery/LiveConnectionDetail.jsp.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9834?
CVE-2016-9834 has a medium severity rating due to its XSS nature, allowing remote script execution.
How do I fix CVE-2016-9834?
To fix CVE-2016-9834, update Sophos Cyberoam firmware to a version later than 10.6.4.
Is user interaction required to exploit CVE-2016-9834?
Yes, user interaction is required for CVE-2016-9834 as the victim must visit a malicious page.
What products are affected by CVE-2016-9834?
CVE-2016-9834 affects Sophos Cyberoam firewall devices running firmware up to version 10.6.4.
What type of attack does CVE-2016-9834 enable?
CVE-2016-9834 enables remote attackers to execute arbitrary client-side scripts via cross-site scripting (XSS).