CVE-2016-1609

MEDIUM

Novell Filr <1.2 SU3 & <2.0 SU2 - XSS

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2016-1609. PoCs published by SEC Consult.

AI-analyzed exploit summary This is a detailed security advisory from SEC Consult describing multiple vulnerabilities in Micro Focus Filr, including CSRF, OS command injection, XSS, and authentication bypass. It includes proof-of-concept code for exploiting these vulnerabilities.

Description

Multiple cross-site scripting (XSS) vulnerabilities in Novell Filr before 1.2 Security Update 3 and 2.0 before Security Update 2 allow remote authenticated users to inject arbitrary web script or HTML via crafted input, as demonstrated by a crafted attribute of an IMG element in the phone field of a user profile.

Exploits (1)

exploitdb WRITEUP VERIFIED

by SEC Consult · textwebappsjava

https://www.exploit-db.com/exploits/40161

View Code ZIP pw:eip

This is a detailed security advisory from SEC Consult describing multiple vulnerabilities in Micro Focus Filr, including CSRF, OS command injection, XSS, and authentication bypass. It includes proof-of-concept code for exploiting these vulnerabilities.

Classification

Writeup 100%

Attack Type

Rce, Xss, Auth Bypass

Complexity

Moderate

Reliability

Reliable

Target: Micro Focus Filr 2 <=2.0.0.421, Filr 1.2 <= 1.2.0.846

No auth needed

Prerequisites: Network access to the target system · For some exploits, an authenticated session

MITRE ATT&CK