Software Engineering Institute

The web interface of the ForeScout CounterACT appliance contains reflected XSS vulnerabilities (CWE-79). The following are a couple examples:

hxxp://xxx.xxx.xxx.xxx/status?username=test"><script>alert(1);</script>
hxxp://xxx.xxx.xxx.xxx/status?action=4362907358160917120&forgotpass=true&loginname=test<script>alert(1);</script>

Additional details may be found in ForeScout Security Advisory 12-01. (Login Required)

A remote attacker may, by luring a user into clicking a malicious URL, be able to disclose sensitive information, steal user cookies, or escalate privileges.

Apply an Update

• CounterACT 6.3.3.2 install Hotfix 4.12050
• CounterACT 6.3.4.0 install Hotfix 10.0
• CounterACT 6.3.4.1 install Hotfix 6.0
• CounterACT 6.3.4.10 install Hotfix 1.0