[R4] SecurityCenter 5.3.1 Fixes Multiple Vulnerabilities

SecurityCenter 5.2.0 was found vulnerable to three cross-site scripting issues. If exploited, a victim could be tricked into executing attacker-controlled JavaScript that runs in the their own context, potentially leading to authentication credential disclosure or other attacks. A fourth issue, an authenticated path disclosure weakness, has also been addressed.

• CVE-2016-82008 - Reflected XSS. An unauthenticated attacker could craft a URL that can be used against an authenticated SecurityCenter user. (NN Group N.V.)
• CVE-2016-82009 - Stored XSS. An authenticated attacker with user privileges could embed malicious JavaScript that would be stored by SecurityCenter, and subsequently rendered by other users loading a specific page. (NN Group N.V.)
• CVE-2016-82010 - Reflected XSS. An unauthenticated attacker could craft a URL that can be used against an authenticated SecurityCenter user. (NN Group N.V.)
• CVE-2016-82011 - System path disclosure weakness (post-auth). (NN Group N.V.)

In addition to these fixes, SecurityCenter now implements a variety of HTTP headers and Cookie flags to further enhance security. Thanks to both CESG and NN Group N.V. for pointing out methods for accomplishing this. Note that the CVSSv2 score associated with this advisory reflects the most severe issue by the scoring standards, which is the reflected XSS.

Please note that Tenable strongly recommends that SecurityCenter be installed on a subnet that is not Internet addressable.