WatchGuard Dimension Reflected DOM-Based XSS in Report Detail Page

Summary #

A Reflected Cross-Site Scripting (XSS) vulnerability in WatchGuard Dimension's report detail page allows an attacker to execute arbitrary JavaScript in a authenticated user's browser with a specially crafted URL.

Impact: A remote attacker can craft a link that, when clicked by an authenticated Dimension user with report access, executes arbitrary JavaScript in the context of the Dimension Web UI. This can be used to perform same-origin actions as the victim, read same-origin page data, or be chained with other state-changing endpoints or CSRF weaknesses in the Dimension Web UI. Exploitation requires the victim to be authenticated, hold report-viewing permission for the target device, and to open an attacker-supplied link.