Reflected Cross-Site Scripting Vulnerability in ArcSight ESM and ArcSight ESM Express

CVE-2017-13986

Summary

A reflected Cross-Site Scripting (XSS) vulnerability exists in ArcSight ESM and ArcSight ESM Express that allows an attacker to inject malicious scripts into a response from the server. This vulnerability affects any version of ArcSight ESM 6.x prior to 6.9.1c Patch 4 or ArcSight ESM Express 6.11.0 Patch 1. By crafting a specific URL, attackers can exploit the vulnerability to gain unintended access to sensitive information from users, potentially leading to further attacks.

References