CVE:CVE-2013-7025
CNNVD:CNNVD-201312-154
Dell SonicWALL Global Management System（GMS）、Analyzer都是美国戴尔（Dell）公司的产品。Dell SonicWALL GMS是一套全球管理系统，可快速部署和集中管理SonicWALL基础架构。Dell SonicWALL Analyzer是一套针对SonicWALL基础架构的网络分析器软件。Dell SonicWALL UMA EM5000是一套通用管理设备软件。
Dell SonicWALL GMS，Analyzer，UMA EM5000 Hotfix 134235之前的7.1 SP1版本中的Alert Settings部分中的ematStaticAlertTypes.jsp脚本中存在跨站脚本漏洞，该漏洞源于createNewThreshold.jsp脚本没有正确过滤‘valfield_1’和‘value_1’参数。远程经过授权的攻击者可通过创建特制的请求利用该漏洞注入任意Web脚本或HTML。
solution:Upgrade sonicwall analyzer to a higher version than 7.0,7.1,7.1:sp1,and avoid the version 7.0,7.1,7.1:sp1; Upgrade sonicwall global_management_system to a higher version than 7.0,7.1,7.1:sp1,and avoid the version 7.0,7.1,7.1:sp1; Upgrade sonicwall uma_e5000_firmware to a higher version than 7.0,7.1,7.1:sp1,and avoid the version 7.0,7.1,7.1:sp1