Possible DOM XSS in SNS Web Administration Portal

Overview

It is possible to execute a DOM-based Cross-Site Scripting attack against Stormshield’s web administration panel.

To exploit this vulnerability, an attacker would need to craft a URL containing a malicious script payload within a specific parameter and lure an authenticated administrator into visiting that link.

Affected

• network_security >= 5.0.0 <= 5.0.9
• network_security >= 5.1.0 <= 5.1.3

Remediation

The following updates will fix this vulnerability:

• SNS 5.1.4 EA

• SNS 5.0.10

Workarounds

There is no workaround solution.