CVE-2017-14615

An FBX-5313 issue was discovered in WatchGuard Fireware before 12.0. When a failed login attempt is made to the login endpoint of the XML-RPC interface, if JavaScript code, properly encoded to be consumed by XML parsers, is embedded as value of the user element, the code will be rendered in the context of any logged in user in the Web UI visiting "Traffic Monitor" sections "Events" and "All." As a side effect, no further events will be visible in the Traffic Monitor until the device is restarted.

• CWE-79

• http://seclists.org/bugtraq/2017/Sep/22Exploit, Mailing List, Third Party Advisory
• https://watchguardsupport.secure.force.com/publicKB?type=KBSecurityIssues&SFDCID=kA62A0000000L0HSAU&lang=en_USVendor Advisory
• https://www.sidertia.com/Home/Community/Blog/2017/09/18/Fixed-Fireware-XXE-DOS-and-stored-XSS-vulnerabilities-discovered-by-SidertiaExploit, Third Party Advisory
• http://seclists.org/bugtraq/2017/Sep/22Exploit, Mailing List, Third Party Advisory
• https://watchguardsupport.secure.force.com/publicKB?type=KBSecurityIssues&SFDCID=kA62A0000000L0HSAU&lang=en_USVendor Advisory
• https://www.sidertia.com/Home/Community/Blog/2017/09/18/Fixed-Fireware-XXE-DOS-and-stored-XSS-vulnerabilities-discovered-by-SidertiaExploit, Third Party Advisory

Published

Sep 20, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-14609The server daemons in Kannel 1.5.0 and earlier create a PID …
• CVE-2017-1461IBM DOORS Next Generation (DNG/RRC) 4.0, 5.0, and 6.0 is vul…
• CVE-2017-14610bareos-dir, bareos-fd, and bareos-sd in bareos-core in Bareo…
• CVE-2017-14611SSRF (Server Side Request Forgery) in Cockpit 0.13.0 allows …
• CVE-2017-14612"Shpock Boot Sale & Classifieds" app before 3.17.0 -- aka sh…
• CVE-2017-14614Directory traversal vulnerability in the Visor GUI Console i…
• CVE-2017-14616An FBX-5312 issue was discovered in WatchGuard Fireware befo…
• CVE-2017-14617In Poppler 0.59.0, a floating point exception occurs in the …
• CVE-2017-14618Cross-site scripting (XSS) vulnerability in inc/PMF/Faq.php …
• CVE-2017-14619Cross-site scripting (XSS) vulnerability in phpMyFAQ through…
• CVE-2017-1462IBM Rhapsody DM 5.0 and 6.0 is vulnerable to cross-site scri…
• CVE-2017-14620SmarterStats Version 11.3.6347 will Render the Referer Field…