Packeteer Products File Listing XSS

Credit: nnposter
Risk: Low
Local: No
Remote: Yes

CVSS Base Score: 4.3/10
Impact Subscore: 2.9/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: None
Integrity impact: Partial
Availability impact: None

Packeteer Products File Listing XSS Product: Packeteer PacketShaper Packeteer PolicyCenter The web management interface of several Packeteer products contains a cross-site scripting vulnerability in the file listing function. Parameter FILELIST, specified in an arbitrary page request, is not sufficiently sanitized before it gets embedded in the HTML output of the Error Report page. (The parameter value is limited to 64 characters.) Example: https://(target)/whatever.htm?FILELIST=%3C/script%3E%3Cbody+onLoad=alert (%26quot%3BXSS%26quot%3B)%3E%3Cscript%3E The vulnerability has been identified in version 8.2.2. However, other versions may be also affected. Solution: Do not stay logged into the Packeteer web management interface while browsing other web sites. Found by: nnposter

Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022,


Back to Top