CVE-2017-5998: XSS
Cross-site scripting (XSS) vulnerability in InterSect Alliance SNARE Epilog for UNIX version 1.5 allows remote authenticated users to inject arbitrary web script or HTML via the strlogname parameter in a "Web Admin Portal > Log Configuration > Add" action.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
InterSect Alliance SNARE Epilog for UNIXto a version that resolves this vulnerability.Fixed in 1.5 - Compensating control
Restrict access to the SNARE Epilog Web Admin Portal (Web Admin Portal > Log Configuration) to trusted users only, since authenticated users can inject arbitrary web script/HTML via the str_log_name parameter.
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5998?
CVE-2017-5998 is classified as a cross-site scripting vulnerability which can lead to significant security risks for affected users.
How do I fix CVE-2017-5998?
To fix CVE-2017-5998, upgrade to a secured version of SNARE Epilog that addresses this XSS vulnerability.
Who is affected by CVE-2017-5998?
CVE-2017-5998 affects users of InterSect Alliance SNARE Epilog version 1.5.0 on UNIX systems.
What kind of attack can be conducted using CVE-2017-5998?
An attacker can exploit CVE-2017-5998 to inject arbitrary web scripts or HTML, potentially leading to data theft or session hijacking.
Is user authentication required to exploit CVE-2017-5998?
Yes, CVE-2017-5998 can only be exploited by remote authenticated users due to its nature.