CVE-2016-8581

Published: Oct 28, 2016Modified: May 6, 2026

6.1

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

A persistent XSS vulnerability exists in the User-Agent header of the login process of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to steal session IDs of logged in users when the current sessions are viewed by an administrator.

Affected (2)

Products: Alienvault: Open Source Security Information And Event Management, Unified Security Management

Alienvault

2 products

Open Source Security Information And Event Management

Unified Security Management

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Alienvault Open Source Security Information And Event Management	Up to 5.3.1
Alienvault Unified Security Management	Up to 5.3.1

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (6)

http://www.securityfocus.com/bid/93862

Source: cve@mitre.org

https://www.alienvault.com/forums/discussion/7766/security-advisory-alienvault-5-3-2-address-70-vulnerabilities

Source: cve@mitre.org

Vendor Advisory

https://www.exploit-db.com/exploits/40683/

Source: cve@mitre.org

http://www.securityfocus.com/bid/93862

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.alienvault.com/forums/discussion/7766/security-advisory-alienvault-5-3-2-address-70-vulnerabilities

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://www.exploit-db.com/exploits/40683/

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.