CVEvulnerability

CVE-2016-3968

6.1 MEDIUM Published 2016-04-06 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2016-04-06
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
6.1 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
Weaknesses
CWE-79

Description

Multiple cross-site scripting (XSS) vulnerabilities in Sophos Cyberoam CR100iNG UTM appliance with firmware 10.6.3 MR-1 build 503, CR35iNG UTM appliance with firmware 10.6.2 MR-1 build 383, and CR35iNG UTM appliance with firmware 10.6.2 Build 378 allow remote attackers to inject arbitrary web script or HTML via the (1) ipFamily parameter to corporate/webpages/trafficdiscovery/LiveConnections.jsp; the (2) ipFamily, (3) applicationname, or (4) username parameter to corporate/webpages/trafficdiscovery/LiveConnectionDetail.jsp; or the (5) X-Forwarded-For HTTP header.

Affected configurations

• sophos cyberoam cr100ing utm firmware 10.6.3 mr-1 build 503 • sophos cyberoam cr35ing utm firmware 10.6.2 build 378 • sophos cyberoam cr35ing utm firmware 10.6.2 mr-1 build 383

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References