CVE-2005-2186

Vulnerability

The McAfee IntruShield Security Management System (ISM) contains a stored cross-site scripting (XSS) vulnerability in SystemEvent.jsp. The thirdMenuName and resourceName parameters are not sanitized before being displayed, allowing authenticated users to inject arbitrary web script or HTML [1]. This affects all versions prior to the June 2005 maintenance patch as indicated by the vendor [2].

Exploitation

An attacker must have authenticated access to the ISM console with privileges to create or modify menu or resource entries. The attacker supplies a malicious payload in the thirdMenuName or resourceName parameter. When any user (including administrators) views the affected page, the injected script executes in the context of their browser session [1]. No additional user interaction is required beyond viewing the page.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the victim's browser. This can lead to theft of session cookies, UI redressing, or performing unauthorized actions on behalf of the victim. Because the script runs in the security context of the administration console, an attacker may escalate their privileges to fully compromise the IntruShield management system [1].

Mitigation

McAfee addressed these vulnerabilities in a maintenance patch released in June 2005 [2]. Administrators should apply the patch or upgrade to the latest supported version. No effective workarounds have been published; restricting access to the management console and reviewing user permissions may reduce risk.