CVE-2020-11711 (stormshield_network_security)

An issue was discovered in Stormshield SNS 3.8.0. Authenticated Stored XSS in the admin login panel leads to SSL VPN credential theft. A malicious disclaimer file can be uploaded from the admin panel. The resulting file is rendered on the authentication interface of the admin panel. It is possible to inject malicious HTML content in order to execute JavaScript inside a victim's browser. This results in a stored XSS on the authentication interface of the admin panel. Moreover, an unsecured …

admin authentication credential credential theft cve disclaimer file html inject interface issue login malicious order panel sns ssl ssl vpn stored xss theft vpn xss