================ Cross-Site Scripting vulnerabilities in HP Network Node Manager i 9.10 Author: 0a29406d9794e4f9b30b3c5d6702c708 twitter.com/0a29 - 0a29.blogspot.com - GMail 0a2940 ================ Description: ================ Multiple XSS vulnerabilities exist within HP NNMi. In the case of GET request XSS, this is due to a poorly implemented filter that does not fully protect against XSS. In the case of POST request XSS, this appears to be due to a lack of any filter. Of particular note is the fact that if the user is not logged in they are presented with the login page and the XSS is activated upon login. ================ Timeline: ================ 01 November 2011 - Reported to HP. No response 10 November 2011 - HP publish HPSBMU02708 SSRT100633 rev.1 - HP Network Node Manager i (NNMi) for HP-UX, Linux, Solaris, and Windows, Remote Cross Site Scripting (XSS) - unknown if related 16 November 2011 - Followup to HP. No response 23 November 2011 - Public disclosure ================ Details: ================ GET ----- http://site/nnm/mibdiscover?node=