Persistent XSS in Plixer Scrutinizer userprefs.cgi

Successful exploitation allows execution of attacker-controlled script in the context of the vulnerable web application within another user's browser session. This can enable session theft, unauthorized actions performed with the victim's privileges, disclosure of application data visible to the victim, interface manipulation, and delivery of further browser-based payloads. If an administrative user views the malicious content, the impact can extend to compromise of administrative functionality within the application. The available note indicates there is some uncertainty about practical severity if exploitation requires privileges already sufficient to create arbitrary script-bearing content.

As an interim measure, restrict access to the administrative and user-management portions of the web console to trusted users and networks, monitor for suspicious modifications to user-related fields, and deploy web application firewall protections capable of detecting or blocking XSS payloads. ModSecurity rules covering these issues were noted as an available defensive control. Additional hardening such as Content Security Policy may reduce exploit reliability, but does not replace patching.

Upgrade Plixer Scrutinizer NetFlow & sFlow Analyzer to version 9.0.1.19899 or later, as the issue appears to have been fixed in the 9.0.1 release line. Ensure the application performs strict server-side validation of user-supplied input and applies context-appropriate output encoding before rendering stored data in HTML responses.