Summary
Sourcefire Defense Center is prone to multiple security vulnerabilities, including multiple arbitrary-file-download vulnerabilities, an arbitrary-file-deletion vulnerability, a security- bypass vulonerability, and an HTML-injection vulnerability.
Exploiting these vulnerabilities may allow an attacker to view or delete arbitrary files within the context of the application, gain unauthorized access and execute HTML and script code in the context of the affected site, steal cookie-based authentication credentials, or control how the site is rendered to the user. Information harvested may aid in launching further attacks.
Sourcefire Defense Center versions prior to 4.10.2.3 are vulnerable.
Solution
Updates are available. Please see the reference for more details.
References
