CVE-2018-19771

Vulnerability

A reflected cross-site scripting (XSS) vulnerability exists in InfoVista VistaPortal SE version 5.1 (build 51029). The page EditCurrentPool.jsp does not properly sanitize user input supplied via the PropName HTTP GET parameter, allowing an attacker to inject arbitrary HTML or JavaScript code.

Exploitation

An attacker can exploit this vulnerability by crafting a malicious URL containing a JavaScript payload in the PropName parameter. The victim must be tricked into clicking the crafted link. No authentication or special privileges are required for the attacker to deliver the payload.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript code in the context of the victim's browser session. This can lead to session hijacking, credential theft, defacement, or redirection to malicious sites.

Mitigation

As of the publication date, no official patch or vendor advisory has been released. The only reference is a public disclosure [1]. Mitigations include input validation and encoding of the PropName parameter, or the use of a web application firewall (WAF) to block malicious requests.