CVEvulnerability
CVE-2016-8581
6.1 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2016-10-28
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 6.1 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
A persistent XSS vulnerability exists in the User-Agent header of the login process of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to steal session IDs of logged in users when the current sessions are viewed by an administrator.
Affected configurations
• alienvault open source security information and event management (<= 5.3.1)
• alienvault unified security management (<= 5.3.1)
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://www.securityfocus.com/bid/93862 www.securityfocus.com
- https://www.alienvault.com/forums/discussion/7766/security-advisory-alienvault-5-3-2-address-70-vulnerabilities Vendor Advisory
- https://www.exploit-db.com/exploits/40683/ www.exploit-db.com
- http://www.securityfocus.com/bid/93862 www.securityfocus.com
- https://www.alienvault.com/forums/discussion/7766/security-advisory-alienvault-5-3-2-address-70-vulnerabilities Vendor Advisory
- https://www.exploit-db.com/exploits/40683/ www.exploit-db.com