NVD Vulnerability Detail

CVE-2017-14615

Summary	An FBX-5313 issue was discovered in WatchGuard Fireware before 12.0. When a failed login attempt is made to the login endpoint of the XML-RPC interface, if JavaScript code, properly encoded to be consumed by XML parsers, is embedded as value of the user element, the code will be rendered in the context of any logged in user in the Web UI visiting "Traffic Monitor" sections "Events" and "All." As a side effect, no further events will be visible in the Traffic Monitor until the device is restarted.
Publication Date	Sept. 21, 2017, 5:29 a.m.
Registration Date	Jan. 26, 2021, 1:16 p.m.
Last Update	Nov. 21, 2024, 12:13 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:o:watchguard:fireware::::::::			11.12.4

Related information, measures and tools

No	URL	タグ
1	http://seclists.org/bugtraq/2017/Sep/22	Exploit Mailing List Third Party Advisory
2	http://seclists.org/bugtraq/2017/Sep/22	Exploit Mailing List Third Party Advisory
3	https://watchguardsupport.secure.force.com/publicKB?type=KBSecurityIssues&SFDCID=kA62A0000000L0HSAU&lang=en_US	Vendor Advisory
4	https://watchguardsupport.secure.force.com/publicKB?type=KBSecurityIssues&SFDCID=kA62A0000000L0HSAU&lang=en_US	Vendor Advisory
5	https://www.sidertia.com/Home/Community/Blog/2017/09/18/Fixed-Fireware-XXE-DOS-and-stored-XSS-vulnerabilities-discovered-by-Sidertia	Exploit Third Party Advisory
6	https://www.sidertia.com/Home/Community/Blog/2017/09/18/Fixed-Fireware-XXE-DOS-and-stored-XSS-vulnerabilities-discovered-by-Sidertia	Exploit Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-79	クロスサイト・スクリプティング（XSS）	https://cwe.mitre.org/data/definitions/79.html

JVN Vulnerability Information

WatchGuard Fireware におけるクロスサイトスクリプティングの脆弱性

Title	WatchGuard Fireware におけるクロスサイトスクリプティングの脆弱性
Summary	WatchGuard Fireware には、クロスサイトスクリプティングの脆弱性が存在します。
Possible impacts	情報を取得される、および情報を改ざんされる可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Sept. 18, 2017, midnight
Registration Date	Oct. 18, 2017, 6:55 p.m.
Last Update	Oct. 18, 2017, 6:55 p.m.

Affected System

ウォッチガード・テクノロジー

WatchGuard Fireware 12.0 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2017-14615	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14615
National Vulnerability Database (NVD)
2	CVE-2017-14615	https://nvd.nist.gov/vuln/detail/CVE-2017-14615

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-79	https://jvndb.jvn.jp/ja/cwe/CWE-79.html

ベンダー情報

No	Name	URL
WatchGuard
1	XTM & Firebox Web UI Stored XSS Vulnerability	https://watchguardsupport.secure.force.com/publicKB?type=KBSecurityIssues&SFDCID=kA62A0000000L0HSAU&lang=en_US

その他

No	Name	URL
関連文書
1	Fixed Fireware XXE DOS and stored XSS vulnerabilities discovered by Sidertia	https://www.sidertia.com/Home/Community/Blog/2017/09/18/Fixed-Fireware-XXE-DOS-and-stored-XSS-vulnerabilities-discovered-by-Sidertia
2	Watchguard Fireware OS DOS & Stored XSS	http://seclists.org/bugtraq/2017/Sep/22

Change Log

No	Changed Details	Date of change
0	[2017年10月18日] 掲載	Feb. 17, 2018, 10:37 a.m.