CVE-2015-20130 in Netsweeper
Summary
by MITRE • 10/30/2026
Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in webadmin/reporter/view_server_log.php that allows remote attackers to execute arbitrary JavaScript by injecting malicious code through the log request parameter, which is reflected into the HTML response without output encoding. Attackers can craft a malicious URL and induce a user to request it, resulting in arbitrary JavaScript execution within the victim's browser session against the Netsweeper web administration interface. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in Netsweeper versions prior to 4.0.11 and 4.1.5 represents a critical security flaw within the web administration interface, specifically located in the reporter module at the path view_server_log.php. This component is responsible for displaying server logs to administrators, but it fails to properly sanitize user-supplied input before including it in the HTML response. The core technical issue is an unvalidated reflection of data from the log request parameter directly into the output stream without applying necessary encoding or escaping mechanisms. This architectural oversight allows malicious actors to inject executable script payloads that are subsequently rendered and executed by the victim's web browser, classifying this as a reflected cross-site scripting vulnerability under CWE-79.
The operational impact of this flaw is significant because it targets the administrative interface rather than end-user facing pages. By crafting a specially designed URL containing malicious JavaScript code within the log parameter, an attacker can trick an authenticated administrator into visiting the link through social engineering or other means. Once accessed, the browser executes the injected script in the context of the Netsweeper application and with the privileges of the logged-in user. This enables the adversary to perform actions on behalf of the administrator, such as modifying configuration settings, exfiltrating sensitive data like session cookies or authentication tokens, or redirecting traffic to malicious sites. The ability to execute arbitrary JavaScript effectively compromises the confidentiality, integrity, and availability of the web filtering solution's management plane.
The presence of this vulnerability was notably confirmed by real-world exploitation evidence observed by the Shadowserver Foundation on October 19, 2023. This observation indicates that active threat actors are already scanning for and exploiting this specific weakness in deployed environments. The attack vector aligns with ATT&CK technique T1189 Drive-by Client Side Scripting, where attackers leverage vulnerabilities to execute code without direct user interaction beyond clicking a link or visiting a page. Furthermore, the lack of input validation corresponds closely to CWE-20 Improper Input Validation and CWE-74 Incorrect Serialization, highlighting fundamental flaws in how the application handles external data inputs within its web framework.
To mitigate this risk, organizations running affected versions must immediately upgrade Netsweeper to version 4.1.5 or later, which includes patches for this specific input handling defect. In scenarios where immediate patching is not feasible due to operational constraints, network-level controls should be implemented to restrict access to the web administration interface exclusively from trusted IP addresses using firewalls or VPNs. Additionally, implementing a Web Application Firewall with rules capable of detecting and blocking reflected XSS payloads can provide an additional layer of defense against exploitation attempts while the system remains vulnerable. Regular security audits and code reviews focusing on output encoding practices are recommended to prevent similar vulnerabilities in future software updates.